← Back

CVE-2024-45736

nvd nist
Published: Oct 14, 2024Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGEST_EVAL" parameter as part of a [Field Transformation](https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms) which could crash the Splunk daemon (splunkd).

Affected (6)

Splunk
2 products
Splunk
Splunk Cloud Platform
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk
From 9.1.0 to 9.1.6
Splunk
From 9.2.0 to 9.2.3
Splunk
Version 9.3.0
Splunk
Splunk Cloud Platform
From 9.1.2312 to 9.1.2312.111
Splunk Cloud Platform
From 9.1.2312.200 to 9.1.2312.204
Splunk Cloud Platform
From 9.2.2403.100 to 9.2.2403.107

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (2)

Source: prodsec@splunk.com
Vendor Advisory
Source: prodsec@splunk.com
Vendor Advisory

Timeline

No history available yet.