{"id":"CVE-2024-53246","state":"PUBLISHED","title":"Sensitive Information Disclosure through SPL commands","description":"In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, such as a Risky Commands Bypass, for successful exploitation.","publishedAt":"2024-12-10T18:01:16.803Z","updatedAt":"2025-02-28T11:03:55.865Z","severity":{"score":5.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","source":"Splunk"},"assigner":"Splunk","products":["Splunk Splunk Enterprise","Splunk Splunk Cloud Platform"],"affected":[{"vendor":"Splunk","product":"Splunk Enterprise","versions":[{"version":"9.3","status":"affected","lessThan":"9.3.2","versionType":"custom"},{"version":"9.2","status":"affected","lessThan":"9.2.4","versionType":"custom"},{"version":"9.1","status":"affected","lessThan":"9.1.7","versionType":"custom"}]},{"vendor":"Splunk","product":"Splunk Cloud Platform","versions":[{"version":"9.3.2408","status":"affected","lessThan":"9.3.2408.101","versionType":"custom"},{"version":"9.2.2406","status":"affected","lessThan":"9.2.2406.106","versionType":"custom"},{"version":"9.2.2403","status":"affected","lessThan":"9.2.2403.111","versionType":"custom"},{"version":"9.1.2312","status":"affected","lessThan":"9.1.2312.206","versionType":"custom"}]}],"references":["https://advisory.splunk.com/advisories/SVD-2024-1204"],"weaknesses":["CWE-319"],"ingestedAt":"2026-10-29T20:08:04.920Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/53xxx/CVE-2024-53246.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-53246","state":"PUBLISHED","datePublished":"2024-12-10T18:01:16.803Z","dateUpdated":"2025-02-28T11:03:55.865Z","assignerShortName":"Splunk","assignerOrgId":"42b59230-ec95-491e-8425-5a5befa1a469","dateReserved":"2024-11-19T18:30:28.773Z"},"containers":{"cna":{"title":"Sensitive Information Disclosure through SPL commands","descriptions":[{"lang":"en","value":"In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and Splunk Cloud Platform versions below 9.3.2408.101, 9.2.2406.106, 9.2.2403.111, and 9.1.2312.206, an SPL command can potentially disclose sensitive information. The vulnerability requires the exploitation of another vulnerability, such as a Risky Commands Bypass, for successful exploitation."}],"affected":[{"vendor":"Splunk","product":"Splunk Enterprise","versions":[{"version":"9.3","status":"affected","lessThan":"9.3.2","versionType":"custom"},{"version":"9.2","status":"affected","lessThan":"9.2.4","versionType":"custom"},{"version":"9.1","status":"affected","lessThan":"9.1.7","versionType":"custom"}]},{"vendor":"Splunk","product":"Splunk Cloud Platform","versions":[{"version":"9.3.2408","status":"affected","lessThan":"9.3.2408.101","versionType":"custom"},{"version":"9.2.2406","status":"affected","lessThan":"9.2.2406.106","versionType":"custom"},{"version":"9.2.2403","status":"affected","lessThan":"9.2.2403.111","versionType":"custom"},{"version":"9.1.2312","status":"affected","lessThan":"9.1.2312.206","versionType":"custom"}]}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2024-1204"}],"metrics":[{"cvssV3_1":{"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1","baseScore":5.3,"baseSeverity":"MEDIUM"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-319","lang":"en","type":"cwe","description":"The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors."}]}],"providerMetadata":{"shortName":"Splunk","orgId":"42b59230-ec95-491e-8425-5a5befa1a469","dateUpdated":"2025-02-28T11:03:55.865Z"},"datePublic":"2024-12-10T00:00:00.000Z","source":{"advisory":"SVD-2024-1204"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-10T20:39:36.685783Z","id":"CVE-2024-53246","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-10T21:13:47.167Z"}}]}}}