CVE-2024-36992

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*
cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*

History

21 Aug 2024, 14:30

Type Values Removed Values Added
CPE cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*
References () https://advisory.splunk.com/advisories/SVD-2024-0712 - () https://advisory.splunk.com/advisories/SVD-2024-0712 - Vendor Advisory
First Time Splunk splunk
Splunk splunk Cloud Platform
Splunk

02 Jul 2024, 12:09

Type Values Removed Values Added
Summary
  • (es) En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10 y en las versiones de Splunk Cloud Platform inferiores a 9.1.2312.200 y 9.1.2308.207, un usuario con pocos privilegios que no tenga los roles de administrador o poder de Splunk podría crear un payload malicioso a través de una Vista que podría resultar en la ejecución de código JavaScript no autorizado en el navegador de un usuario.bEl parámetro "url" del elemento Panel no tiene una validación de entrada adecuada para rechazar URL no válidas, lo que podría provocar un exploit de Cross-Site Scripting (XSS).

01 Jul 2024, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-01 17:15

Updated : 2024-08-21 14:30


NVD link : CVE-2024-36992

Mitre link : CVE-2024-36992

CVE.ORG link : CVE-2024-36992


JSON object : View

Products Affected

splunk

  • splunk_cloud_platform
  • splunk
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')