CVE-2024-53247

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7, and versions below 3.4.261 and 3.7.13 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could perform a Remote Code Execution (RCE).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Splunk	Splunk Enterprise	>= 9.3, < 9.3.2; >= 9.2, < 9.2.4; >= 9.1, < 9.1.7
Splunk	Splunk Secure Gateway	>= 3.7, < 3.7.13; >= 3.4, < 3.4.261

References

https://advisory.splunk.com/advisories/SVD-2024-1205

Timeline

Published: Dec 10, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-53256.5The Form Vibes plugin for WordPress is vulnerable to SQL Injection via the ‘fv_export_data’ parameter in all versions up to, and including, CVE-2024-532535.3Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario wher CVE-2024-532555.4BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In CVE-2024-532567.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a com CVE-2024-532574.9Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do CVE-2024-532585.3Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can d CVE-2024-532596.5quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected qui CVE-2024-53268.8The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due CVE-2024-532606.8Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to i CVE-2024-532615.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* CVE-2024-532625.4SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors CVE-2024-532638.5Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of t