CVE-2024-45734 (GCVE-0-2024-45734)

Vulnerability from cvelistv5 – Published: 2024-10-14 17:03 – Updated: 2025-02-28 11:03
VLAI?
Title
Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard
Summary
In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-284 - The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Assigner
References
Impacted products
Vendor Product Version
Splunk Splunk Enterprise Affected: 9.2 , < 9.2.3 (custom)
Affected: 9.1 , < 9.1.6 (custom)
Create a notification for this product.
Credits
Anton (therceman)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "splunk_enterprise",
            "vendor": "splunk",
            "versions": [
              {
                "lessThan": "9.2.3",
                "status": "affected",
                "version": "9.2",
                "versionType": "custom"
              },
              {
                "lessThan": "9.1.6",
                "status": "affected",
                "version": "9.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45734",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-15T17:35:39.991677Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-15T17:36:41.279Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Splunk Enterprise",
          "vendor": "Splunk",
          "versions": [
            {
              "lessThan": "9.2.3",
              "status": "affected",
              "version": "9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1.6",
              "status": "affected",
              "version": "9.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Anton (therceman)"
        }
      ],
      "datePublic": "2024-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard."
            }
          ],
          "value": "In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-28T11:03:43.384Z",
        "orgId": "42b59230-ec95-491e-8425-5a5befa1a469",
        "shortName": "Splunk"
      },
      "references": [
        {
          "url": "https://advisory.splunk.com/advisories/SVD-2024-1004"
        },
        {
          "url": "https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/"
        }
      ],
      "source": {
        "advisory": "SVD-2024-1004"
      },
      "title": "Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469",
    "assignerShortName": "Splunk",
    "cveId": "CVE-2024-45734",
    "datePublished": "2024-10-14T17:03:30.412Z",
    "dateReserved": "2024-09-05T21:35:21.290Z",
    "dateUpdated": "2025-02-28T11:03:43.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45734\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-15T17:35:39.991677Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:splunk:splunk_enterprise:*:*:*:*:*:*:*:*\"], \"vendor\": \"splunk\", \"product\": \"splunk_enterprise\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.2\", \"lessThan\": \"9.2.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.1\", \"lessThan\": \"9.1.6\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-15T17:36:34.081Z\"}}], \"cna\": {\"title\": \"Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard\", \"source\": {\"advisory\": \"SVD-2024-1004\"}, \"credits\": [{\"lang\": \"en\", \"value\": \"Anton (therceman)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Splunk\", \"product\": \"Splunk Enterprise\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.2\", \"lessThan\": \"9.2.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.1\", \"lessThan\": \"9.1.6\", \"versionType\": \"custom\"}]}], \"datePublic\": \"2024-10-14T00:00:00.000Z\", \"references\": [{\"url\": \"https://advisory.splunk.com/advisories/SVD-2024-1004\"}, {\"url\": \"https://research.splunk.com/application/7464e2dc-98a5-4af9-87a1-fa6d5a256fa6/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \\\"admin\\\" or \\\"power\\\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In Splunk Enterprise versions 9.3.0, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \\\"admin\\\" or \\\"power\\\" Splunk roles could view images on the machine that runs Splunk Enterprise by using the PDF export feature in Splunk classic dashboards. The images on the  machine could be exposed by exporting the dashboard as a PDF, using the local image path in the img tag in the source extensible markup language (XML) code for the Splunk classic dashboard.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"cwe\", \"cweId\": \"CWE-284\", \"description\": \"The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.\"}]}], \"providerMetadata\": {\"orgId\": \"42b59230-ec95-491e-8425-5a5befa1a469\", \"shortName\": \"Splunk\", \"dateUpdated\": \"2025-02-28T11:03:43.384Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45734\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-28T11:03:43.384Z\", \"dateReserved\": \"2024-09-05T21:35:21.290Z\", \"assignerOrgId\": \"42b59230-ec95-491e-8425-5a5befa1a469\", \"datePublished\": \"2024-10-14T17:03:30.412Z\", \"assignerShortName\": \"Splunk\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.