Path Traversal: '.../...//' (CWE-35)
A path traversal vulnerability exists in the /modules/messaging/ endpoint of Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. This vulnerability is specific to Splunk Enterprise on Windows platforms and could allow an attacker to perform unauthorized path traversal.
The vulnerability has a high severity with a CVSS v3.1 base score of 7.5. It primarily affects confidentiality, with no impact on integrity or availability. An attacker exploiting this vulnerability could potentially gain unauthorized access to sensitive files or directories outside the intended directory structure. The attack vector is network-based, requires low complexity, no privileges, and no user interaction, making it relatively easy to exploit. This could lead to exposure of sensitive information, potentially compromising the confidentiality of data stored or processed by the affected Splunk Enterprise installations.
Multiple proof-of-concept exploits are available on github.com, github.com, github.com, github.com. Its exploitation has been reported by various sources, including github.com.
Patches are available. Users should upgrade to Splunk Enterprise versions 9.2.2, 9.1.5, or 9.0.10 or later, depending on their current version track.
1. Prioritize upgrading Splunk Enterprise on Windows to version 9.2.2, 9.1.5, or 9.0.10 or later, as appropriate for your version track. 2. If immediate patching is not possible, implement network segmentation to limit access to the vulnerable /modules/messaging/ endpoint. 3. Monitor for suspicious activities or unauthorized access attempts targeting this endpoint. 4. Implement strong access controls and authentication mechanisms for Splunk Enterprise. 5. Regularly audit and review file system permissions to ensure proper access restrictions are in place.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD published the first details for CVE-2024-36991
Feedly found the first article mentioning CVE-2024-36991. See article
Feedly estimated the CVSS score as HIGH
This CVE started to trend in security discussions
Detection for the vulnerability has been added to Nessus (201217)
Detection for the vulnerability has been added to Qualys (380010)
EPSS Score was set to: 0.04% (Percentile: 9.2%)
This CVE stopped trending in security discussions