High severity · published Jul 1, 2024
CVE-2024-36983
Command Injection using External Lookups
8.8
CVSS
1%
EPSS
No
On KEV
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on the Splunk platform Instance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Splunk Cloud Platform · Splunk
9.1.2312 before 9.1.2312.109; 9.1.2308 before 9.1.2308.207 · source: vendor, NVD, CISA
SE
Splunk Enterprise · Splunk
9.2 before 9.2.2; 9.1 before 9.1.5; 9.0 before 9.0.10 · source: vendor
SP
Splunk · Splunk
9.0.0 before 9.0.10; 9.1.0 before 9.1.5; 9.2.0 before 9.2.2 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36983
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36983
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2024-0703
Tool Signature
https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/
More from Splunk Cloud Platform
9.1
CVE-2022-32151
The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default…
8.8
CVE-2026-20251
Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway
8.8
CVE-2025-20371
Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise
8.8
CVE-2023-40598
In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function
8.8
CVE-2023-40597
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk