Splunk Enterprise <9.3.1: Low-Privilege Crash via INGEST_EVAL Field Transf.
CVE-2024-45736 Published on October 14, 2024

Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon
In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).

NVD

Weakness Type

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2024-45736 has been classified to as a Resource Exhaustion vulnerability or weakness.


Products Associated with CVE-2024-45736

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-45736 are published in these products:

Splunk
 
Splunk Cloud Platform
 

Affected Versions

Splunk Enterprise: Splunk Cloud Platform: splunk_enterprise: splunk_cloud_platform:

Exploit Probability

EPSS
0.19%
Percentile
41.24%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.