CVE-2024-45733

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.2.3 Splunk Enterprise versions prior to 9.1.6

Description The issue is related to insecure session storage configuration in Splunk Enterprise for Windows, allowing a low-privileged user without the "admin" or "power" Splunk roles to perform Remote Code Execution (RCE). This is due to deficiencies in the deserialization mechanism of the Splunk Web component.

Recommendations For versions prior to 9.2.3, update to version 9.2.3 or later. For versions prior to 9.1.6, update to version 9.1.6 or later. As a temporary workaround, consider restricting access to the session storage configuration to minimize the risk of exploitation.