CVE-2024-23678CWE-20

Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition

High · published January 22, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
11.8
In the wild
Unconfirmed
What it is

In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2024-01-22T20:37Z
EPSS history
Timeline
  • 22 JAN 20:37Z
    Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition
    cvelistv5