{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-22T23:33:48.449","vulnerabilities":[{"cve":{"id":"CVE-2024-36992","sourceIdentifier":"prodsec@splunk.com","published":"2024-07-01T17:15:08.077","lastModified":"2026-06-17T07:37:33.520","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and 9.1.2308.207, a low-privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through a View that could result in execution of unauthorized JavaScript code in the browser of a user. The “url” parameter of the Dashboard element does not have proper input validation to reject invalid URLs, which could lead to a Persistent Cross-site Scripting (XSS) exploit."},{"lang":"es","value":"En las versiones de Splunk Enterprise inferiores a 9.2.2, 9.1.5 y 9.0.10 y en las versiones de Splunk Cloud Platform inferiores a 9.1.2312.200 y 9.1.2308.207, un usuario con pocos privilegios que no tenga los roles de administrador o poder de Splunk podría crear un payload malicioso a través de una Vista que podría resultar en la ejecución de código JavaScript no autorizado en el navegador de un usuario.bEl parámetro \"url\" del elemento Panel no tiene una validación de entrada adecuada para rechazar URL no válidas, lo que podría provocar un exploit de Cross-Site Scripting (XSS)."}],"affected":[{"source":"prodsec@splunk.com","affectedData":[{"vendor":"Splunk","product":"Splunk Enterprise","versions":[{"version":"9.2","lessThan":"9.2.2","versionType":"custom","status":"affected"},{"version":"9.1","lessThan":"9.1.5","versionType":"custom","status":"affected"},{"version":"9.0","lessThan":"9.0.10","versionType":"custom","status":"affected"}]},{"vendor":"Splunk","product":"Splunk Cloud Platform","versions":[{"version":"9.1.2312","lessThan":"9.1.2312.200","versionType":"custom","status":"affected"},{"version":"9.1.2308","lessThan":"9.1.2308.207","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"prodsec@splunk.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-01T20:51:04.772976Z","id":"CVE-2024-36992","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"prodsec@splunk.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.10","matchCriteriaId":"09264EE5-FA8A-49C5-AB1F-AEAC16CDC591"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.1.0","versionEndExcluding":"9.1.5","matchCriteriaId":"565039EE-74F6-451C-AFB3-F6C9F7AA0EEE"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.2.0","versionEndExcluding":"9.2.2","matchCriteriaId":"B1342052-4733-49BB-95F0-A89B07A3F2E3"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"9.1.2308","versionEndExcluding":"9.1.2308.207","matchCriteriaId":"D220E842-2B15-416F-960B-397166883F9F"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"9.1.2312","versionEndExcluding":"9.1.2312.200","matchCriteriaId":"7783EE7D-586D-4245-9B62-204240F5B6A3"}]}]}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2024-0712","source":"prodsec@splunk.com","tags":["Vendor Advisory"]},{"url":"https://advisory.splunk.com/advisories/SVD-2024-0712","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}}]}