CVE-2024-36989: Low-privileged user could create notifications in Splunk Web Bulletin Messages
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36989?
CVE-2024-36989 has a low severity rating due to its exploitation being limited to low-privileged users.
How do I fix CVE-2024-36989?
To mitigate CVE-2024-36989, upgrade to Splunk Enterprise version 9.2.2 or later, 9.1.5 or later, or 9.0.10 or later, or the appropriate version of Splunk Cloud Platform.
Who is affected by CVE-2024-36989?
CVE-2024-36989 affects Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, as well as Splunk Cloud Platform versions below 9.1.2312.200.
What types of users can exploit CVE-2024-36989?
CVE-2024-36989 can be exploited by low-privileged users who do not have admin or power roles.
What is the impact of CVE-2024-36989?
The impact of CVE-2024-36989 allows low-privileged users to create notifications that are visible to all users on the instance.