medium4.6
CVE-2024-23676
In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to vie…
Impact
In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Splunk | Cloud | before 9.1.2308.200 |
| Splunk | Splunk | from 9.0.0 before 9.0.8 from 9.1.0 before 9.1.3 |