CVE-2024-45739

MEDIUM

Splunk < 9.3.1, < 9.2.3, < 9.1.6 - Plaintext Password Exposure in AdminManager Debug Log

Title source: llm
STIX 2.1

Description

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level.

References (2)

Core 2

Scores

CVSS v3 4.9
EPSS 0.0051
EPSS Percentile 39.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-532 CWE-200
Status published
Products (2)
splunk/splunk 9.3.1
splunk/splunk 9.1.0 - 9.1.6
Published Oct 14, 2024
Tracked Since Feb 18, 2026