CVE-2024-45731

Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk

State: Published
Severity: 8.0 High
Published: Oct 14, 2024
Updated: Feb 28, 2025
Reserved: Sep 5, 2024

Read the record on cve.org

Description

In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H	Splunk

Weaknesses

CWE-23 The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	9.3 to before 9.3.1Affected 9.2 to before 9.2.3Affected 9.1 to before 9.1.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.