← Back

CVE-2024-53245

nvd nist
Published: Dec 10, 2024Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard name and the dashboard XML by cloning the dashboard.

Affected (3)

Splunk
2 products
Splunk
Splunk Cloud Platform
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk
From 9.1.0 to 9.1.7
Splunk
From 9.2.0 to 9.2.4
Splunk Cloud Platform
From 9.1.2312 to 9.1.2312.206

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

Source: prodsec@splunk.com
Vendor Advisory

Timeline

No history available yet.