CVE-2024-53246 — Sensitive Information Disclosure through SPL commands

Description (CNA)

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, such as a Risky Commands Bypass, for successful exploitation.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 9.3 before 9.3.2; affected 9.2 before 9.2.4; affected 9.1 before 9.1.7
Splunk / Splunk Cloud Platform	affected 9.3.2408 before 9.3.2408.101; affected 9.2.2406 before 9.2.2406.106; affected 9.2.2403 before 9.2.2403.111; affected 9.1.2312 before 9.1.2312.206

CWE

CWE-319

References

https://advisory.splunk.com/advisories/SVD-2024-1204

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.