Vulnerability · Published Oct 14, 2024 · Assigned by Splunk
CVE-2024-45741Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise
Medium 5.4
In plain English
A medium-severity cross-site scripting in Splunk Cloud Platform from Splunk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 14.8% (higher than 97% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configuration file that the "api.uri" parameter from the "/manager/search/apps/local" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 9.2 – before 9.2.39.1 – before 9.1.6 |
| Splunk | Splunk Cloud Platform | 9.2.2403 – before 9.2.2403.1089.1.2312 – before 9.1.2312.205 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N