CVE-2024-23678

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Jan 22, 2024
Updated: Jan 29, 2024
CWE ID 20

Summary

CVE-2024-23678 is a vulnerability that affects Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3. The vulnerability arises from the incorrect sanitization of path input data, leading to the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability has a base severity rating of HIGH with a base score of 8.8 according to NIST's National Vulnerability Database (NVD). The exploitability score is 2.0, and the vulnerability requires low privileges and has no user interaction. The attack vector is local, and it has a high impact on integrity and confidentiality, as well as high availability impact. The affected products include 'r-aB4S', 'tDwx34', 'r-aB4T', 'tjDv0n', 'tjDv0m', 'uUaW_q', 'qGYeCx', 'uUaW_p', 'tDwx31', and 'tDwx33'. Organizations using Splunk Enterprise for Windows below the mentioned versions should upgrade to version 9.0.8 or 9.1.3 to remediate this vulnerability and mitigate potential risks to their systems and data.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23678 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options