CVE-2024-45732

Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

State: Published
Severity: 7.1 High
Published: Oct 14, 2024
Updated: Feb 28, 2025
Reserved: Sep 5, 2024

Description

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	Splunk

Weaknesses

CWE-862 The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	9.3 to before 9.3.1Affected 9.2 to before 9.2.3Affected
Splunk Cloud PlatformSplunk	9.2.2403 to before 9.2.2403.103Affected 9.1.2312 to before 9.1.2312.110, 9.1.2312.200Affected 9.1.2308 to before 9.1.2308.208Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.