Vulnerability · Published Jul 1, 2024 · Assigned by Splunk
CVE-2024-36985Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise
High 8.8
In plain English
A high-severity security flaw in Splunk Enterprise from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.5% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)6.5%top 6.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Metasploit, Public PoC
Official description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the “splunk_archiver“ application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 9.2 – before 9.2.29.1 – before 9.1.59.0 – before 9.0.10 |
Weakness: CWE-687 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H