What’s Vulnerable › Vulnerabilities

CVE-2024-36997: Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-01 · updated 2026-06-17
• Weakness: CWE-79

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.

Affected products

• Splunk Enterprise: from 9.0.0 before 9.0.10; from 9.1.0 before 9.1.5; from 9.2.0 before 9.2.2 — fixed in 9.0.10, 9.1.5, 9.2.2
• Splunk Cloud Platform: from 9.1.2312 before 9.1.2312.100 — fixed in 9.1.2312.100

How to fix

Upgrade to a fixed version: Splunk Enterprise 9.0.10, 9.1.5, 9.2.2; Splunk Cloud Platform 9.1.2312.100. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2024-0717
• https://research.splunk.com/application/ed1209ef-228d-4dab-9856-be9369925a5c
• https://advisory.splunk.com/advisories/SVD-2024-0717
• https://research.splunk.com/application/ed1209ef-228d-4dab-9856-be9369925a5c

Get alerted when CVE-2024-36997 or the next vulnerability affects your stack