Splunk Enterprise up to 9.1.5/9.2.2 PDF Export access control

Summaryinfo

A vulnerability, which was classified as critical, was found in Splunk Enterprise up to 9.1.5/9.2.2. This affects an unknown part of the component PDF Export. Executing a manipulation can lead to access control. This vulnerability is tracked as CVE-2024-45734. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Splunk Enterprise up to 9.1.5/9.2.2 and classified as critical. This vulnerability affects some unknown functionality of the component PDF Export. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality. CVE summarizes:

In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.

The advisory is available at advisory.splunk.com. This vulnerability was named CVE-2024-45734 since 09/05/2024. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 208943 (Splunk Enterprise 9.1.0 < 9.1.6, 9.2.0 < 9.2.3 (SVD-2024-1004)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.1.6, 9.2.3 or 9.3.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (208943). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Enterprise

Version

• 9.1.0
• 9.1.1
• 9.1.2
• 9.1.3
• 9.1.4
• 9.1.5
• 9.2.0
• 9.2.1
• 9.2.2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion