CyberzSOC

These vulnerabilities could lead to arbitrary file write to Windows system root directory, access to potentially restricted data and remote code execution [1,2]. The vulnerability CVE-2024-45733, with a CVSS score of 8.8, could allow a low-privileged user that does not hold the “admin” or “power” Splunk roles to perform a Remote Code Execution (RCE) due to an insecure session storage configuration. The vulnerability CVE-2024-45731, with a CVSS score of 8.0, could allow a low-privileged user that does not hold the “admin” or “power” Splunk roles to write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive. The user could potentially write a malicious DLL which, if loaded, could result in a remote execution of the code within that DLL. The vulnerability CVE-2024-45732, with a CVSS score of 7.1, could allow a low-privileged user that does not hold the “admin” or “power” Splunk roles to run a search as the “nobody” Splunk user in the SplunkDeploymentServerConfig app.