What’s Vulnerable › Vulnerabilities

CVE-2024-36983: Command Injection using External Lookups

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-01 · updated 2026-06-17
• Weakness: CWE-77

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109 and 9.1.2308.207, an authenticated user could create an external lookup that calls a legacy internal function. The authenticated user could use this internal function to insert code into the Splunk platform installation directory. From there, the user could execute arbitrary code on the Splunk platform Instance.

Affected products

• Splunk Enterprise: from 9.0.0 before 9.0.10; from 9.1.0 before 9.1.5; from 9.2.0 before 9.2.2 — fixed in 9.0.10, 9.1.5, 9.2.2
• Splunk Cloud Platform: from 9.1.2308 before 9.1.2308.207; from 9.1.2312 before 9.1.2312.109 — fixed in 9.1.2308.207, 9.1.2312.109

How to fix

Upgrade to a fixed version: Splunk Enterprise 9.0.10, 9.1.5, 9.2.2; Splunk Cloud Platform 9.1.2308.207, 9.1.2312.109. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2024-0703
• https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/
• https://advisory.splunk.com/advisories/SVD-2024-0703
• https://research.splunk.com/application/1cf58ae1-9177-40b8-a26c-8966040f11ae/

Get alerted when CVE-2024-36983 or the next vulnerability affects your stack