CVE-2024-23678
Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition
- State
- Published
- Severity
- 7.5 High
- Published
- Jan 22, 2024
- Updated
- Jun 17, 2025
- Reserved
- Jan 19, 2024
Description
In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | Splunk |
Weaknesses
- CWE-20 The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
Affected Products
| Product | Versions |
|---|---|
Splunk EnterpriseSplunk |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.