CVE-2024-23676

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2024-0106	Vendor Advisory
https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:cloud::::::::
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*

History

29 Jan 2024, 17:57

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:a:splunk:cloud:::::::: cpe:2.3:a:splunk:splunk:::::enterprise:::*
References	~~() https://advisory.splunk.com/advisories/SVD-2024-0106 -~~	() https://advisory.splunk.com/advisories/SVD-2024-0106 - Vendor Advisory
References	~~() https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/ -~~	() https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/ - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~4.6~~	v2 : unknown v3 : 3.5
First Time		Splunk splunk Splunk cloud Splunk

24 Jan 2024, 19:15

Type	Values Removed	Values Added
References		() https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/ -

23 Jan 2024, 13:44

Type	Values Removed	Values Added
Summary		(es) En las versiones de Splunk inferiores a 9.0.8 y 9.1.3, el comando SPL “mrollup” permite a un usuario con pocos privilegios ver métricas en un índice para el que no tiene permiso. Esta vulnerabilidad requiere la interacción de un usuario con altos privilegios para poder explotarla.

22 Jan 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-22 21:15

Updated : 2024-04-10 01:15

NVD link : CVE-2024-23676

Mitre link : CVE-2024-23676

CVE.ORG link : CVE-2024-23676

JSON object : View

Products Affected

splunk

splunk
cloud

CWE

NVD-CWE-noinfo CWE-20

Improper Input Validation

{"id": "CVE-2024-23676", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Secondary", "source": "prodsec@splunk.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "published": "2024-01-22T21:15:10.530", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2024-0106", "tags": ["Vendor Advisory"], "source": "prodsec@splunk.com"}, {"url": "https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/", "tags": ["Vendor Advisory"], "source": "prodsec@splunk.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "prodsec@splunk.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "In Splunk versions below 9.0.8 and 9.1.3, the \u201cmrollup\u201d SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit."}, {"lang": "es", "value": "En las versiones de Splunk inferiores a 9.0.8 y 9.1.3, el comando SPL \u201cmrollup\u201d permite a un usuario con pocos privilegios ver m\u00e9tricas en un \u00edndice para el que no tiene permiso. Esta vulnerabilidad requiere la interacci\u00f3n de un usuario con altos privilegios para poder explotarla."}], "lastModified": "2024-04-10T01:15:18.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:cloud:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F37499F-F597-4CE3-8E14-E53AE6B46202", "versionEndExcluding": "9.1.2308.200"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "51D25D9F-2F3B-4A9A-B468-1DF8EB682692", "versionEndExcluding": "9.0.8", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "125F126C-4B0F-4B3D-891F-498E6DE761D7", "versionEndExcluding": "9.1.3", "versionStartIncluding": "9.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "prodsec@splunk.com"}