Low-privileged user could create notifications in Splunk Web Bulletin Messages

Advisory ID: SVD-2024-0709

CVE ID: CVE-2024-36989

Published: 2024-07-01

Last Update: 2024-07-01

CVSSv3.1 Score: 6.5, Medium

CWE: CWE-284

Bug ID: VULN-15234


In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200, a low-privileged user that does not hold the “admin” or “power” Splunk roles could create notifications in Splunk Web Bulletin Messages that all users on the instance receive.

This could be the result of a lack of access control for using the Bulletin Messages system to send notifications.

It may be possible for the notifications to contain Web links. This could result in administrators navigating to other Web pages or running searches unexpectedly.


Upgrade Splunk Enterprise to versions 9.2.2, 9.1.5, and 9.0.10, or higher.

Splunk is performing upgrades on Splunk Cloud Platform instances as part of Routine Maintenance for customers, as described in the Splunk Cloud Platform Maintenance Policy. In the meantime, Splunk is actively monitoring for potential issues that could arise from this vulnerability.

Product Status

ProductVersionComponentAffected VersionFix Version
Splunk Enterprise9.2Splunk Web9.2.0 to
Splunk Enterprise9.1Splunk Web9.1.0 to
Splunk Enterprise9.0Splunk Web9.0.0 to
Splunk Cloud Platform9.1.2312Splunk WebBelow 9.1.2312.2009.1.2312.200

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web turned on. You could turn Splunk Web off as a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning Splunk Web off.



Splunk rates this vulnerability as 6.5, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

If the Splunk Enterprise instance does not run Splunk Web, there should be no impact and the severity would be informational.


Anton (therceman)