CVE-2024-36995

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could create experimental items.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
SplunkSplunk Enterprise>= 9.2, < 9.2.2; >= 9.1, < 9.1.5; >= 9.0, < 9.0.10
SplunkSplunk Cloud Platform>= 9.1.2312, < 9.1.2312.200; >= 9.1.2308, < 9.1.2308.207

References

Timeline

Published
Jul 1, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-369965.3In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determCVE-2024-369978.1In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store anCVE-2024-369997.8A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bounds Write. A malicious acCVE-2024-37009.8Use of hard-coded password to the patients' database allows an attacker to retrieve sensitive data stored in the database. The password is tCVE-2024-370007.8A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can lead to a memory corruption vulnerability by CVE-2024-370017.8A maliciously crafted 3DM file, when parsed in opennurbs.dll through Autodesk applications, can be used to cause a Heap-based Overflow. A maCVE-2024-370027.8A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This CVE-2024-370037.8A maliciously crafted DWG and SLDPRT file, when parsed in opennurbs.dll and ODXSW_DLL.dll through Autodesk applications, can be used to causCVE-2024-370047.8A maliciously crafted SLDPRT file, when parsed in ASMKERN229A.dll through Autodesk applications, can cause a use-after-free vulnerability. TCVE-2024-370057.8A maliciously crafted X_B file, when parsed in pskernel.DLL through Autodesk applications, can force an Out-of-Bound Read. A malicious actorCVE-2024-370067.8A maliciously crafted CATPRODUCT file, when parsed in CC5Dll.dll through Autodesk applications, can lead to a memory corruption vulnerabilitCVE-2024-370077.8A maliciously crafted X_B and X_T file, when parsed in pskernel.DLL through Autodesk applications, can cause a use-after-free vulnerability.
CVE-2024-36995: Low severity, CVSS 3.5 | Vulnix