Security News > 2024 > July > Critical Splunk flaw can be exploited to grab passwords (CVE-2024-36991)

A recently fixed vulnerability affecting Splunk Enterprise on Windows "Is more severe than it initially appeared," according to SonicWall's threat researchers.

Splunk Enterprise is a data analytics and monitoring platform that allows organization to collect and analyze machine-generated data from a variety of sources, such as network and security devices, servers, etc.

It can be exploited with a specially crafted GET request, and allows an attacker to perform a directory listing on the Splunk endpoint.

CVE-2024-36991 affects Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, but only on Windows, and only if the Splunk Web component is turned on.

"Although Splunk is famous mainly for dev environments, up to 230k exposed servers are running Splunk according to Fofa," the threat researchers noted, and advised admins to implement the patch immediately.

Disabling Splunk Web also removes the risk of exploitation, though upgrading to a fixed version is preferred.

News URL

https://www.helpnetsecurity.com/2024/07/18/cve-2024-36991-poc/