Medium severity · published Oct 14, 2024
CVE-2024-45734
Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Splunk Enterprise · Splunk
9.2 before 9.2.3; 9.1 before 9.1.6 · source: vendor, CISA
SP
Splunk · Splunk
9.1.0 before 9.1.6; 9.2.0 before 9.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45734
Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2024-1004
Vendor Advisory
https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/
More from Splunk Enterprise
9.8
CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
9.9
CVE-2026-76302
Security Hardening in Splunk Enterprise - October 2026
9.9
CVE-2026-76299
Security Hardening in Splunk Enterprise - October 2026
9.8
CVE-2026-76301
Security Hardening in Splunk Enterprise - October 2026
9.8
CVE-2026-76285
Improper Adherence to Coding Standards in Splunk Enterprise