CVE-2024-45741

Deeper analysis

CVE-2024-45741 is a cross-site scripting vulnerability affecting Splunk Enterprise versions below 9.2.3 and 9.1.6 as well as Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205. A low-privileged user without the admin or power role can supply a malicious payload via a custom configuration file referenced by the api.uri parameter on the /manager/search/apps/local endpoint in Splunk Web, resulting in unauthorized JavaScript execution in a victim's browser.

An attacker with limited Splunk access can exploit the flaw by crafting the configuration file so that the stored payload executes when another user views the affected page. Successful exploitation allows the attacker to run arbitrary JavaScript in the context of the targeted user's session, potentially leading to limited data exposure or session manipulation while the CVSS vector reflects network attack vector, low complexity, and required user interaction.

The referenced Splunk advisory SVD-2024-1011 and associated research note direct customers to upgrade Splunk Enterprise to 9.2.3 or 9.1.6 and Splunk Cloud Platform to 9.2.2403.108 or 9.1.2312.205 to remediate the issue. The EPSS score has remained flat at 0.0530 with no material increase since disclosure.