CVE-2024-36984
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2024-07-01 17:15:06.480000
Last modified
2026-11-04 00:17:19.117000
View original CVE JSON
{
"id": "CVE-2024-36984",
"sourceIdentifier": "[email protected]",
"published": "2024-07-01T17:15:06.480",
"lastModified": "2026-11-04T00:17:19.117",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 on Windows, an authenticated user could execute a specially crafted query that they could then use to serialize untrusted data. The attacker could use the query to execute arbitrary code."
},
{
"lang": "es",
"value": "En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10 en Windows, un usuario autenticado podría ejecutar una consulta especialmente manipulada que luego podría usar para serializar datos que no sean de confianza. El atacante podría utilizar la consulta para ejecutar código arbitrario."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"versions": [
{
"version": "9.2",
"lessThan": "9.2.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.1",
"lessThan": "9.1.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.0",
"lessThan": "9.0.10",
"versionType": "custom",
"status": "affected"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"vendor": "splunk",
"product": "enterprise_security",
"defaultStatus": "unknown",
"cpes": [
"cpe:2.3:a:splunk:enterprise_security:9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:splunk:enterprise_security:9.1:*:*:*:*:*:*:*",
"cpe:2.3:a:splunk:enterprise_security:9.2:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "9.0",
"lessThan": "9.0.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.1",
"lessThan": "9.1.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.2",
"lessThan": "9.2.2",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-07-10T03:55:19.496959Z",
"id": "CVE-2024-36984",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.0.0",
"versionEndExcluding": "9.0.10",
"matchCriteriaId": "09264EE5-FA8A-49C5-AB1F-AEAC16CDC591"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.1.0",
"versionEndExcluding": "9.1.5",
"matchCriteriaId": "565039EE-74F6-451C-AFB3-F6C9F7AA0EEE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.2.0",
"versionEndExcluding": "9.2.2",
"matchCriteriaId": "B1342052-4733-49BB-95F0-A89B07A3F2E3"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-0704",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/",
"source": "[email protected]",
"tags": [
"Tool Signature"
]
},
{
"url": "https://advisory.splunk.com/advisories/SVD-2024-0704",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Tool Signature"
]
}
]
}