Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2024-53245

Information Disclosure due to Username Collision with a Role that has the same Name as the User

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Splunk

Description

In Splunk Enterprise versions below 9.3.0, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.1.2312.206, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles, that has a username with the same name as a role with read access to dashboards, could see the dashboard name and the dashboard XML by cloning the dashboard.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Splunk Splunk Enterprise

  • 9.2 to < 9.2.4affected
  • 9.1 to < 9.1.7affected

Splunk Splunk Cloud Platform

  • 9.1.2312 to < 9.1.2312.206affected

References