CVE-2024-53243: Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway
4.3
CVSS
Description
In Splunk Enterprise versions below 9.3.2, 9.2.4, and 9.1.7 and versions below 3.2.462, 3.7.18, and 3.8.5 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could see alert search query responses using Splunk Secure Gateway App Key Value Store (KVstore) collections endpoints due to improper access control.
Classification
CVE ID: CVE-2024-53243
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.3
Affected Products
Vendor: Splunk
Product: Splunk Enterprise
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.44% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)