CVE-2024-36986: splunk cloud
Vulnerability summary
CVE-2024-36986 is a medium (CVSS 6.3) vulnerability in splunk cloud. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32% of scored vulnerabilities.
Timeline
- 01-07-2024PublishedVulnerability first disclosed.
- 28-02-2025Last modifiedVulnerability information updated.
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, an authenticated user could run risky commands using the permissions of a higher-privileged user to bypass SPL safeguards for risky commands in the Analytics Workspace. The vulnerability requires the authenticated user to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk4 products
- cloud≥ 9.1.2308, < 9.1.2308.207 | ≥ 9.1.2312, < 9.1.2312.200
- splunk≥ 9.0.0, < 9.0.10 | ≥ 9.1.0, < 9.1.5 | ≥ 9.2.0, < 9.2.2
- splunk_cloud_platform≥ 9.1.2312, < 9.1.2312.200 | ≥ 9.1.2308, < 9.1.2308.207
- splunk enterprise≥ 9.2, < 9.2.2 | ≥ 9.1, < 9.1.5 | ≥ 9.0, < 9.0.10
1 vendor · 4 products
References
2 links- advisory.splunk.com/advisories/SVD-2024-0706Vendor Advisory