Unrated severityNVD Advisory· Published Jul 1, 2024· Updated Feb 28, 2025
Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint
CVE-2024-36997
Description
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312, an admin user could store and execute arbitrary JavaScript code in the browser context of another Splunk user through the conf-web/settings REST endpoint. This could potentially cause a persistent cross-site scripting (XSS) exploit.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4<9.1.2312+ 1 more
- (no CPE)range: <9.1.2312
- (no CPE)range: 9.1.2312
<9.2.2, <9.1.5, <9.0.10+ 1 more
- (no CPE)range: <9.2.2, <9.1.5, <9.0.10
- (no CPE)range: 9.2
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.