Splunk Enterprise Security up to 7.1.1 Investigation denial of service

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Splunk Enterprise Security up to 7.1.1. Affected is an unknown function of the component Investigation Handler. The manipulation leads to denial of service. This vulnerability is traded as CVE-2024-22165. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Splunk Enterprise Security up to 7.1.1 (Log Management Software). This issue affects an unknown functionality of the component Investigation Handler. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. The summary by CVE is:

In Splunk Enterprise Security (ES) versions lower than 7.1.2, an attacker can create a malformed Investigation to perform a denial of service (DoS). The malformed investigation prevents the generation and rendering of the Investigations manager until it is deleted.The vulnerability requires an authenticated session and access to create an Investigation. It only affects the availability of the Investigations manager, but without the manager, the Investigations functionality becomes unusable for most users.

The weakness was shared 01/09/2024 as SVD-2024-0102. It is possible to read the advisory at advisory.splunk.com. The identification of this vulnerability is CVE-2024-22165 since 01/05/2024. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 7.1.2, 7.2.0 or 7.3.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Enterprise Security

Version

• 7.1.0
• 7.1.1

License

• free

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion