CVE-2024-23676 — Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerabil…

Published: 2024-01-22 · CVSS: 4.6 · CVSS 3.1

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.

Original CVE JSON · STIX 2.1

Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7