CVE-2024-45733: Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows
Published Oct 14, 2024
·Updated
In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.
Affected Software
3 affected components
All of the following
Any of the following
Splunk splunk>=9.1.0<9.1.6
Splunk splunk>=9.2.0<9.2.3
Microsoft Windows
Event History
Oct 14, 2024
CVE Published
via MITRE·05:03 PM
Data Sourced
via MITRE·05:03 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-45733?
CVE-2024-45733 is classified as a low-severity vulnerability due to its requirement for low-privileged user access.
2
How do I fix CVE-2024-45733?
To mitigate CVE-2024-45733, upgrade Splunk Enterprise to version 9.2.3 or 9.1.6 or later.
3
What is the impact of CVE-2024-45733?
CVE-2024-45733 allows a low-privileged user to perform Remote Code Execution due to insecure session storage.
4
Which versions of Splunk are affected by CVE-2024-45733?
CVE-2024-45733 affects Splunk Enterprise versions prior to 9.2.3 and 9.1.6.
5
Can CVE-2024-45733 be exploited without authentication?
CVE-2024-45733 requires a low-privileged authenticated user to exploit the vulnerability.