CVE-2024-23675 - Vulnerability Details - OpenCVE

In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0009.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Splunk	Cloud Splunk

Configuration 1 [-]

OR	cpe:2.3:a:splunk:cloud::::::::
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-21146	In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://advisory.splunk.com/advisories/SVD-2024-0105
https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/

History

Mon, 21 Oct 2024 11:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Splunk

Published: 2024-01-22T20:37:23.117Z

Updated: 2025-02-28T11:03:59.164Z

Reserved: 2024-01-19T16:28:17.340Z

Link: CVE-2024-23675

Vulnrichment

Updated: 2024-08-01T23:06:25.378Z

NVD

Status : Modified

Published: 2024-01-22T21:15:10.263

Modified: 2024-11-21T08:58:08.930

Link: CVE-2024-23675

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23675", "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469", "state": "PUBLISHED", "assignerShortName": "Splunk", "dateReserved": "2024-01-19T16:28:17.340Z", "datePublished": "2024-01-22T20:37:23.117Z", "dateUpdated": "2025-02-28T11:03:59.164Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "9.0", "status": "affected", "versionType": "custom", "lessThan": "9.0.8"}, {"version": "9.1", "status": "affected", "versionType": "custom", "lessThan": "9.1.3"}]}, {"product": "Splunk Cloud", "vendor": "Splunk", "versions": [{"version": "-", "status": "affected", "versionType": "custom", "lessThan": "9.1.2312.100"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections."}], "value": "In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2024-0105"}, {"url": "https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/"}], "title": "Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion", "datePublic": "2024-01-22T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.", "cweId": "CWE-284"}]}], "source": {"advisory": "SVD-2024-0105"}, "credits": [{"lang": "en", "value": "Julian Kaufmann"}], "providerMetadata": {"orgId": "42b59230-ec95-491e-8425-5a5befa1a469", "shortName": "Splunk", "dateUpdated": "2025-02-28T11:03:59.164Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:25.378Z"}, "title": "CVE Program Container", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2024-0105", "tags": ["x_transferred"]}, {"url": "https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-01-23T18:20:30.290043Z", "id": "CVE-2024-23675", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T10:41:48.690Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2024-0105", "tags": ["x_transferred"]}, {"url": "https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:06:25.378Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-23675", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-23T18:20:30.290043Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T10:41:12.102Z"}}], "cna": {"title": "Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion", "source": {"advisory": "SVD-2024-0105"}, "credits": [{"lang": "en", "value": "Julian Kaufmann"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "9.0", "lessThan": "9.0.8", "versionType": "custom"}, {"status": "affected", "version": "9.1", "lessThan": "9.1.3", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud", "versions": [{"status": "affected", "version": "-", "lessThan": "9.1.2312.100", "versionType": "custom"}]}], "datePublic": "2024-01-22T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2024-0105"}, {"url": "https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/"}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.", "supportingMedia": [{"type": "text/html", "value": "In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-284", "description": "The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor."}]}], "providerMetadata": {"orgId": "42b59230-ec95-491e-8425-5a5befa1a469", "shortName": "Splunk", "dateUpdated": "2025-02-28T11:03:59.164Z"}}}, "cveMetadata": {"cveId": "CVE-2024-23675", "state": "PUBLISHED", "dateUpdated": "2025-02-28T11:03:59.164Z", "dateReserved": "2024-01-19T16:28:17.340Z", "assignerOrgId": "42b59230-ec95-491e-8425-5a5befa1a469", "datePublished": "2024-01-22T20:37:23.117Z", "assignerShortName": "Splunk"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:splunk:cloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD58A503-42FB-4CCA-9ABE-2DBC42440867", "versionEndExcluding": "9.1.2312.100", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "51D25D9F-2F3B-4A9A-B468-1DF8EB682692", "versionEndExcluding": "9.0.8", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "125F126C-4B0F-4B3D-891F-498E6DE761D7", "versionEndExcluding": "9.1.3", "versionStartIncluding": "9.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise inferiores a 9.0.8 y 9.1.3, el almac\u00e9n de valores clave de la aplicaci\u00f3n Splunk (KV Store) maneja incorrectamente los permisos para los usuarios que usan la interfaz de programaci\u00f3n de aplicaciones (API) REST. Potencialmente, esto puede resultar en la eliminaci\u00f3n de las colecciones de KV Store."}], "id": "CVE-2024-23675", "lastModified": "2024-11-21T08:58:08.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "prodsec@splunk.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-22T21:15:10.263", "references": [{"source": "prodsec@splunk.com", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2024-0105"}, {"source": "prodsec@splunk.com", "tags": ["Vendor Advisory"], "url": "https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2024-0105"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/"}], "sourceIdentifier": "prodsec@splunk.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "prodsec@splunk.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}