CVE-2024-36982

Published: Jul 1, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an attacker could trigger a null pointer reference on the cluster/config REST endpoint, which could result in a crash of the Splunk daemon.

Affected (5)

Products: Splunk: Cloud, Splunk

Splunk

2 products

Cloud

Splunk

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Splunk Cloud	From 9.1.2308 to 9.1.2308.207
Splunk Cloud	From 9.1.2312.100 to 9.1.2312.109
Splunk Splunk	From 9.0.0 to 9.0.10
Splunk Splunk	From 9.1.0 to 9.1.5
Splunk Splunk	From 9.2.0 to 9.2.2

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (2)

https://advisory.splunk.com/advisories/SVD-2024-0702

Source: prodsec@splunk.com

Vendor Advisory

https://advisory.splunk.com/advisories/SVD-2024-0702

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.