CVE-2024-23675CWE-284

Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion

Medium · published January 22, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
30.4
In the wild
Unconfirmed
What it is

In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00376 · 30.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-01-22T20:37Z
EPSS history
Timeline
  • 22 JAN 20:37Z
    Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion
    cvelistv5