CVE-2024-45732: Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-14 · updated 2026-06-17
Weakness: CWE-862

Description

In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a search as the "nobody" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.

Affected products

Splunk Enterprise: from 9.2.0 before 9.2.3; 9.3.0 — fixed in 9.2.3
Splunk Cloud Platform: before 9.1.2308.208; from 9.1.2312.100 before 9.1.2312.110; from 9.2.2403.102 before 9.2.2403.103 — fixed in 9.1.2308.208, 9.1.2312.110, 9.2.2403.103

How to fix

Upgrade to a fixed version: Splunk Enterprise 9.2.3; Splunk Cloud Platform 9.1.2308.208, 9.1.2312.110, 9.2.2403.103. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-45732 or the next vulnerability affects your stack