CVE-2024-36985

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10

Description A low-privileged user that does not hold the admin or power Splunk roles could cause a Remote Code Execution through an external lookup that references the splunk archiver application. This issue allows for remote code execution, potentially leading to significant security breaches.

Recommendations For versions prior to 9.2.2, update to version 9.2.2 or later. For versions prior to 9.1.5, update to version 9.1.5 or later. For versions prior to 9.0.10, update to version 9.0.10 or later. As a temporary workaround, consider restricting access to the splunk archiver application until a patch is applied.