CVE-2024-23678 — Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition

CVE-2024-23678

Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition PUBLISHED

Description (CNA)

In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 9.0 before 9.0.8; affected 9.1 before 9.1.3

CWE

CWE-20

References

https://advisory.splunk.com/advisories/SVD-2024-0108
https://research.splunk.com/application/947d4d2e-1b64-41fc-b32a-736ddb88ce97/

ADP enrichment

CVE

No English description supplied.

https://advisory.splunk.com/advisories/SVD-2024-0108
https://research.splunk.com/application/947d4d2e-1b64-41fc-b32a-736ddb88ce97/

CISA-ADP

No English description supplied.

No references supplied.