CVE Vulnerabilities

CVE-2024-36989

Published: Jul 01, 2024 | Modified: Oct 10, 2024
CVSS 3.x
4.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.

Affected Software

Name Vendor Start Version End Version
Cloud Splunk 9.1.2312 (including) 9.1.2312.200 (excluding)
Splunk Splunk 9.0.0 (including) 9.0.10 (excluding)
Splunk Splunk 9.1.0 (including) 9.1.5 (excluding)
Splunk Splunk 9.2.0 (including) 9.2.2 (excluding)

References