CVE-2024-36989

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the admin or power Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
SplunkSplunk Enterprise>= 9.2, < 9.2.2; >= 9.1, < 9.1.5; >= 9.0, < 9.0.10
SplunkSplunk Cloud Platform>= 9.1.2312, < 9.1.2312.200

References

Timeline

Published
Jul 1, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-36999.8Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is tCVE-2024-369906.5In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an authenticated, low-prCVE-2024-369917.5In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaginCVE-2024-369925.4In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-pCVE-2024-369935.4In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-pCVE-2024-369945.4In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-pCVE-2024-369953.5In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-pCVE-2024-369965.3In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determCVE-2024-369978.1In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store anCVE-2024-369997.8A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bounds Write. A malicious acCVE-2024-37009.8Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is tCVE-2024-370007.8A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can lead to a memory corruption vulnerability by
CVE-2024-36989: Medium severity, CVSS 4.3 | Vulnix