Vulnerability Description
In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk | >= 9.0.0, < 9.0.8 |
Related Weaknesses (CWE)
References
- https://advisory.splunk.com/advisories/SVD-2024-0108Vendor Advisory
- https://research.splunk.com/application/947d4d2e-1b64-41fc-b32a-736ddb88ce97/Vendor Advisory
- https://advisory.splunk.com/advisories/SVD-2024-0108Vendor Advisory
- https://research.splunk.com/application/947d4d2e-1b64-41fc-b32a-736ddb88ce97/Vendor Advisory
FAQ
What is CVE-2024-23678?
CVE-2024-23678 is a vulnerability with a CVSS score of 7.5 (HIGH). In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a sepa...
How severe is CVE-2024-23678?
CVE-2024-23678 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-23678?
Check the references section above for vendor advisories and patch information. Affected products include: Splunk Splunk.