The vulnerability of the Splunk Enterprise operating analysis platform lies in the incorrect limitation of the path name to the restricted access directory, allowing a malicious user to write any file into the root directory of the Windows system.

🗓️ 30 Oct 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Splunk Enterprise operating analysis platform flaw allows writing files to Windows root due to incorrect path restriction.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-45731	14 Oct 202420:01	–	circl
CNNVD	Splunk Enterprise 安全漏洞	14 Oct 202400:00	–	cnnvd
CVE	CVE-2024-45731	14 Oct 202416:46	–	cve
Cvelist	CVE-2024-45731 Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk	14 Oct 202416:46	–	cvelist
EUVD	EUVD-2024-41736	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Splunk Enterprise	15 Oct 202415:18	–	ncsc
NVD	CVE-2024-45731	14 Oct 202417:15	–	nvd
OSV	CVE-2024-45731	14 Oct 202417:15	–	osv
Tenable Nessus	Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3, 9.3.0 < 9.3.1 (SVD-2024-1001)	14 Oct 202400:00	–	nessus
Vulnrichment	CVE-2024-45731 Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk	14 Oct 202416:46	–	vulnrichment

Vulners

Node

splunk splunk_enterpriseRange9.1.0–9.1.6

OR

splunk splunk_enterpriseRange9.2.0–9.2.3

OR

splunk splunk_enterpriseMatch9.3.0

Source	Link
vuldb	www.vuldb.com/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45731
advisory	www.advisory.splunk.com/advisories/SVD-2024-1001
vulners	www.vulners.com/nvd/NVD:CVE-2024-45731
web	www.web.nvd.nist.gov/view/vuln/detail

30 Oct 2024 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 27.1

CVSS 38

EPSS0.00535

splunk enterprise windows root path restriction file write vulnerability restricted directory