CVE-2024-36992

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2024-0712	Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2024-0712	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::

History

21 Nov 2024, 09:22

Type	Values Removed	Values Added
References	~~() https://advisory.splunk.com/advisories/SVD-2024-0712 - Vendor Advisory~~	() https://advisory.splunk.com/advisories/SVD-2024-0712 - Vendor Advisory

21 Aug 2024, 14:30

Type	Values Removed	Values Added
References	~~() https://advisory.splunk.com/advisories/SVD-2024-0712 -~~	() https://advisory.splunk.com/advisories/SVD-2024-0712 - Vendor Advisory
CPE		cpe:2.3:a:splunk:splunk_cloud_platform:::::::: cpe:2.3:a:splunk:splunk:::::enterprise:::*
First Time		Splunk splunk Splunk Splunk splunk Cloud Platform

02 Jul 2024, 12:09

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-01 17:15

Updated : 2024-11-21 09:22

NVD link : CVE-2024-36992

Mitre link : CVE-2024-36992

CVE.ORG link : CVE-2024-36992

JSON object : View

Products Affected

splunk

splunk_cloud_platform
splunk

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-36992", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "prodsec@splunk.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2024-07-01T17:15:08.077", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2024-0712", "tags": ["Vendor Advisory"], "source": "prodsec@splunk.com"}, {"url": "https://advisory.splunk.com/advisories/SVD-2024-0712", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "prodsec@splunk.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The \u201curl\u201d parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10 y en las versiones de Splunk Cloud Platform inferiores a 9.1.2312.200 y 9.1.2308.207, un usuario con pocos privilegios que no tenga los roles de administrador o poder de Splunk podr\u00eda crear un payload malicioso a trav\u00e9s de una Vista que podr\u00eda resultar en la ejecuci\u00f3n de c\u00f3digo JavaScript no autorizado en el navegador de un usuario.bEl par\u00e1metro \"url\" del elemento Panel no tiene una validaci\u00f3n de entrada adecuada para rechazar URL no v\u00e1lidas, lo que podr\u00eda provocar un exploit de Cross-Site Scripting (XSS)."}], "lastModified": "2024-11-21T09:22:59.493", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "09264EE5-FA8A-49C5-AB1F-AEAC16CDC591", "versionEndExcluding": "9.0.10", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "565039EE-74F6-451C-AFB3-F6C9F7AA0EEE", "versionEndExcluding": "9.1.5", "versionStartIncluding": "9.1.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "B1342052-4733-49BB-95F0-A89B07A3F2E3", "versionEndExcluding": "9.2.2", "versionStartIncluding": "9.2.0"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D220E842-2B15-416F-960B-397166883F9F", "versionEndExcluding": "9.1.2308.207", "versionStartIncluding": "9.1.2308"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7783EE7D-586D-4245-9B62-204240F5B6A3", "versionEndExcluding": "9.1.2312.200", "versionStartIncluding": "9.1.2312"}], "operator": "OR"}]}], "sourceIdentifier": "prodsec@splunk.com"}