← Back

CVE-2024-36990

nvd nist
Published: Jul 1, 2024Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to the datamodel/web REST endpoint in Splunk Enterprise, potentially causing a denial of service.

Affected (6)

Splunk
2 products
Splunk
Splunk Cloud Platform
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk
From 9.0.0 to 9.0.10
Splunk
From 9.1.0 to 9.1.5
Splunk
From 9.2.0 to 9.2.2
Splunk
Splunk Cloud Platform
From 9.1.2308 to 9.1.2308.209
Splunk Cloud Platform
From 9.1.2312.100 to 9.1.2312.109
Splunk Cloud Platform
From 9.1.2312.200 to 9.1.2312.202

Related CWEs

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (4)

Source: prodsec@splunk.com
Vendor Advisory
Source: prodsec@splunk.com
ExploitVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitVendor Advisory

Timeline

No history available yet.