CVE-2024-29946

HIGH

Splunk Enterprise <9.2.1, 9.1.4, 9.0.9 - Info Disclosure

Title source: llm
STIX 2.1

Description

In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser.

References (2)

Core 2

Scores

CVSS v3 8.1
EPSS 0.0050
EPSS Percentile 66.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-20 CWE-77
Status published
Products (1)
splunk/splunk 9.0.0 - 9.0.9
Published Mar 27, 2024
Tracked Since Feb 18, 2026