SplunkVULNRICHMENT:CVE-2024-36989CVE-2024-36989 Low-privileged user could create notifications in Splunk Web Bulletin Messages
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
6.9 Medium
AI Score
Confidence
Low
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.
CNA Affected
[
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"versions": [
{
"status": "affected",
"version": "9.2",
"lessThan": "9.2.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.1",
"lessThan": "9.1.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "9.0",
"lessThan": "9.0.10",
"versionType": "custom"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Cloud Platform",
"versions": [
{
"status": "affected",
"version": "9.1.2312",
"lessThan": "9.1.2312.200",
"versionType": "custom"
}
]
}
]Related
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
6.9 Medium
AI Score
Confidence
Low