DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Splunk Enterprise: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2024-10-14
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu erzeugen.
01
beschreibt (11)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45741US | medium5.4 | — | ||
In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or… | ||||
| CVE-2024-45740US | medium5.4 | — | ||
In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the "admin" or "power" Splunk roles… | ||||
| CVE-2024-45739US | medium4.9 | — | ||
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could… | ||||
| CVE-2024-45738US | medium4.9 | — | ||
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you… | ||||
| CVE-2024-45737US | low3.5 | — | ||
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "a… | ||||
| CVE-2024-45736US | medium6.5 | — | ||
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does n… | ||||
| CVE-2024-45735US | medium4.3 | — | ||
In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user th… | ||||
| CVE-2024-45734US | medium4.3 | — | ||
In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splun… | ||||
| CVE-2024-45733US | high8.8 | — | ||
In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution… | ||||
| CVE-2024-45732US | medium6.5OT erhöht | — | ||
In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low… | ||||
| CVE-2024-45731US | high8.0 | — | ||
In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Wind… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Splunk Security Advisories Archive vom 2024-10-14external
- Splunk Security Advisory vom 2024-10-14external
- Splunk Security Advisory vom 2024-10-14external
- Splunk Security Advisory vom 2024-10-14external
- Splunk Security Advisory vom 2024-10-14external
- Splunk Security Advisory vom 2024-10-14external
- Splunk Security Advisory vom 2024-10-14external
- Splunk Security Advisory vom 2024-10-14external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan