In Splunk Enterprise versions below 9.2.3 and 9.1.6 and...
Moderate severity
Unreviewed
Published
Oct 14, 2024
to the GitHub Advisory Database
•
Updated Oct 14, 2024
Description
Published by the National Vulnerability Database
Oct 14, 2024
Published to the GitHub Advisory Database
Oct 14, 2024
Last updated
Oct 14, 2024
In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom configuration file that the "api.uri" parameter from the "/manager/search/apps/local" endpoint in Splunk Web calls. This could result in execution of unauthorized JavaScript code in the browser of a user.
References