CVE-2024-36997: splunk Cross-site Scripting
Vulnerability summary
CVE-2024-36997 is a high (CVSS 8.1) Cross-site Scripting vulnerability in splunk. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.7% of scored vulnerabilities.
Timeline
- 01-07-2024PublishedVulnerability first disclosed.
- 28-02-2025Last modifiedVulnerability information updated.
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA4.6MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.55% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk3 products
- splunk≥ 9.0.0, < 9.0.10 | ≥ 9.1.0, < 9.1.5 | ≥ 9.2.0, < 9.2.2
- splunk_cloud_platform≥ 9.1.2312, < 9.1.2312.100
- splunk enterprise≥ 9.2, < 9.2.2 | ≥ 9.1, < 9.1.5 | ≥ 9.0, < 9.0.10
1 vendor · 3 products
References
2 links- advisory.splunk.com/advisories/SVD-2024-0717Vendor Advisory