CVE-2024-45739CWE-200

Sensitive information disclosure in AdminManager logging channel

Medium · published October 14, 2024

CVSS v3.1
4.9
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-10-14T17:03Z
EPSS history
Timeline
  • 14 OCT 17:03Z
    Sensitive information disclosure in AdminManager logging channel
    cvelistv5