Splunk XSS via conf-web/settings (pre-9.2.2, 9.1.5, 9.0.10)
CVE-2024-36997 Published on July 1, 2024
Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2024-36997 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2024-36997
stack.watch emails you whenever new vulnerabilities are published in Splunk or Splunk Cloud Platform. Just hit a watch button to start following.
Affected Versions
Splunk Enterprise:- Version 9.2 and below 9.2.2 is affected.
- Version 9.1 and below 9.1.5 is affected.
- Version 9.0 and below 9.0.10 is affected.
- Version 9.1.2312 and below 9.1.2312.100 is affected.
- Version 9.2 and below 9.2.2 is affected.
- Version 9.1 and below 9.1.5 is affected.
- Version 9.0 and below 9.0.10 is affected.
- Version 9.1.2312 and below 9.1.2312.100 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.