In Splunk Enterprise Security (ES) versions below 7.1.2, an attacker can use investigation attachments to perform a denial of service (DoS) to the Investigation. The attachment endpoint does not properly limit the size of the request which lets an attacker cause the Investigation to become inaccessible.
References
| Link | Resource |
|---|---|
| https://advisory.splunk.com/advisories/SVD-2024-0101 | Vendor Advisory |
| https://research.splunk.com/application/bb85b25e-2d6b-4e39-bd27-50db42edcb8f/ | Vendor Advisory |
| https://advisory.splunk.com/advisories/SVD-2024-0101 | Vendor Advisory |
| https://research.splunk.com/application/bb85b25e-2d6b-4e39-bd27-50db42edcb8f/ | Vendor Advisory |
Configurations
History
21 Nov 2024, 08:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://advisory.splunk.com/advisories/SVD-2024-0101 - Vendor Advisory | |
| References | () https://research.splunk.com/application/bb85b25e-2d6b-4e39-bd27-50db42edcb8f/ - Vendor Advisory |
16 Jan 2024, 17:40
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:splunk:enterprise_security:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| First Time |
Splunk enterprise Security
Splunk |
|
| CWE | CWE-770 | |
| References | () https://advisory.splunk.com/advisories/SVD-2024-0101 - Vendor Advisory | |
| References | () https://research.splunk.com/application/bb85b25e-2d6b-4e39-bd27-50db42edcb8f/ - Vendor Advisory |
10 Jan 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Jan 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-09 17:15
Updated : 2024-11-21 08:55
NVD link : CVE-2024-22164
Mitre link : CVE-2024-22164
CVE.ORG link : CVE-2024-22164
JSON object : View
Products Affected
splunk
- enterprise_security