CVE-2024-45737

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
SplunkCNA
4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
VendorProductVersion
splunksplunk
9.1.0 ≤
𝑥
< 9.1.6
splunksplunk
9.2.0 ≤
𝑥
< 9.2.3
splunksplunk
9.3.0
splunksplunk_cloud_platform
9.1.2312 ≤
𝑥
< 9.1.2312.204
splunksplunk_cloud_platform
9.2.2403.102 ≤
𝑥
< 9.2.2403.108
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://advisory.splunk.com/advisories/SVD-2024-1007
https://research.splunk.com/application/34bac267-a89b-4bd7-a072-a48eef1f15b8/