CVE-2024-36996: splunk Observable Response Discrepancy

Vulnerability summary

CVE-2024-36996 is a medium (CVSS 5.3) Observable Response Discrepancy vulnerability in splunk. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.5% of scored vulnerabilities.

Timeline

1. 01-07-2024
   PublishedVulnerability first disclosed.
2. 28-02-2025
   Last modifiedVulnerability information updated.

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not another user exists on the instance by deciphering the error response that they would likely receive from the instance when they attempt to log in. This disclosure could then lead to additional brute-force password-guessing attacks. This vulnerability would require that the Splunk platform instance uses the Security Assertion Markup Language (SAML) authentication scheme.

• CWE-204Observable Response DiscrepancyThe product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.