Vulnerability Details CVE-2024-45732
In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 2.9%
CVSS Severity
CVSS v3 Score 7.1
References
Products affected by CVE-2024-45732
-
cpe:2.3:a:splunk:splunk:9.2.0
-
cpe:2.3:a:splunk:splunk:9.2.1
-
cpe:2.3:a:splunk:splunk:9.2.2
-
cpe:2.3:a:splunk:splunk:9.3.0
-
cpe:2.3:a:splunk:splunk_cloud_platform:*
-
cpe:2.3:a:splunk:splunk_cloud_platform:-
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.1.2103
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2105
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2106
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2107
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2109
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2111
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2112
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2201
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2202
-
cpe:2.3:a:splunk:splunk_cloud_platform:8.2.2203
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.0.2209
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.0.2209.3
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.0.2305.100
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.0.2305.200
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.1.2308
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.1.2308.207
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.1.2312.100
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.1.2312.108
-
cpe:2.3:a:splunk:splunk_cloud_platform:9.1.2312.109