« Volver al listado

CVE-2024-53244

Estado: AnalizadaMedia (5.7)—

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on “/en-US/app/search/report“ endpoint through “s“ parameter.<br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Splunk — SplunkSplunk — Splunk Cloud Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-53244",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53244",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-10T20:39:35.464246Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "prodsec@splunk.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "prodsec@splunk.com",
      "affectedData": [
        {
          "vendor": "Splunk",
          "product": "Splunk Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "9.3",
              "lessThan": "9.3.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.2",
              "lessThan": "9.2.4",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.1",
              "lessThan": "9.1.7",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Splunk",
          "product": "Splunk Cloud Platform",
          "versions": [
            {
              "status": "affected",
              "version": "9.2.2406",
              "lessThan": "9.2.2406.107",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.2.2403",
              "lessThan": "9.2.2403.109",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.1.2312",
              "lessThan": "9.1.2312.206",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-10T18:15:41.243",
  "references": [
    {
      "url": "https://advisory.splunk.com/advisories/SVD-2024-1202",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "prodsec@splunk.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "prodsec@splunk.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.2.2406.107, 9.2.2403.109, and 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on “/en-US/app/search/report“ endpoint through “s“ parameter.<br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will."
    },
    {
      "lang": "es",
      "value": "En las versiones de Splunk Enterprise anteriores a 9.3.2, 9.2.4 y 9.1.7 y en las versiones de Splunk Cloud Platform anteriores a 9.2.2406.107, 9.2.2403.109 y 9.1.2312.206, un usuario con pocos privilegios que no tenga los roles de Splunk “admin” o “power” podría ejecutar una búsqueda guardada con un comando riesgoso utilizando los permisos de un usuario con mayores privilegios para eludir las medidas de seguridad de SPL para comandos riesgosos en el punto de conexión “/en-US/app/search/report” a través del parámetro “s”.<br>La vulnerabilidad requiere que el atacante engañe a la víctima para que inicie una solicitud dentro de su navegador. El usuario autenticado no debería poder explotar la vulnerabilidad a voluntad."
    }
  ],
  "lastModified": "2026-06-17T08:08:41.330",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6653C37D-03C0-47C1-BC9C-510EBB0CB4BE",
              "versionEndExcluding": "9.1.7",
              "versionStartIncluding": "9.1.0"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E31DE8DF-1AAD-4570-93E3-711C07FE1227",
              "versionEndExcluding": "9.2.4",
              "versionStartIncluding": "9.2.0"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A709D871-A35B-4CF2-A9D7-23CE29D0A8C6",
              "versionEndExcluding": "9.3.2",
              "versionStartIncluding": "9.3.0"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0338CF9-1AC9-4F45-9A68-06172C6B36A1",
              "versionEndExcluding": "9.1.2312.206",
              "versionStartIncluding": "9.1.2312"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D640552-2CAE-4747-9683-C7DC45D556EF",
              "versionEndExcluding": "9.2.2403.109",
              "versionStartIncluding": "9.2.2403"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C9D4F64-DAA8-4692-AE4F-171777E8D7C3",
              "versionEndExcluding": "9.2.2406.107",
              "versionStartIncluding": "9.2.2406"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "prodsec@splunk.com"
}