CVEvulnerability
CVE-2024-23675
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-01-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-284, CWE-863
Description
In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.
Affected configurations
• splunk cloud (< 9.1.2312.100)
• splunk splunk (>= 9.0.0 < 9.0.8)
• splunk splunk (>= 9.1.0 < 9.1.3)
Related
References
- https://advisory.splunk.com/advisories/SVD-2024-0105 Vendor Advisory
- https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/ Vendor Advisory
- https://advisory.splunk.com/advisories/SVD-2024-0105 Vendor Advisory
- https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/ Vendor Advisory