Vulnerability · Published Jul 1, 2024 · Assigned by Splunk
CVE-2024-36996Information Disclosure of user names
Medium 5.3
In plain English
A medium-severity security flaw in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 9.2 – before 9.2.29.1 – before 9.1.59.0 – before 9.0.10 |
| Splunk | Splunk Cloud Platform | 9.1.2312 – before 9.1.2312.109 |
Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N