CVEvulnerability

CVE-2024-23676

3.5 LOW Published 2024-01-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-01-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1 ([email protected])
3.5 LOW — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-20

Description

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

Affected configurations

• splunk cloud (< 9.1.2308.200) • splunk splunk (>= 9.0.0 < 9.0.8) • splunk splunk (>= 9.1.0 < 9.1.3)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References