Vulnerabilities > CVE-2024-36990 - Infinite Loop vulnerability in Splunk and Splunk Cloud Platform

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

splunk

CWE-835

NVD

Published: 2024-07-01

Updated: 2024-11-21

Summary

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-privileged user that does not hold the admin or power Splunk roles could send a specially crafted HTTP POST request to the datamodel/web REST endpoint in Splunk Enterprise, potentially causing a denial of service.

Vulnerable Configurations

Part	Description	Count
Application	Splunk Splunk Splunk 9.0.0 Splunk Splunk 9.0.3 Splunk Splunk 9.0.4 Splunk Splunk 9.0.6 Splunk Splunk 9.0.7 Splunk Splunk 9.1.0 Splunk Splunk 9.1.0.1 Splunk Splunk 9.1.0.2 Splunk Splunk 9.1.1 Splunk Splunk 9.1.2 Splunk Splunk 9.1.3 Splunk Splunk * Splunk Splunk Cloud Platform *	13

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References