Sensitive information disclosure in AdminManager logging channel

published 2024-10-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-41687

cvss: 4.9; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits: 0; none known

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level.

Patch / fix

fixed in 1

Splunk Splunk Enterprise 9.1.6, 9.2.3, 9.3.1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-10-14)

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Splunk Splunk Enterprise

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-532 Insertion of Sensitive Information into Log File

References

advisory.splunk.com /advisories/SVD-2024-1009
vendor-advisory
research.splunk.com /application/93dc7182-c5da-4085-82ec-401abf33d623/
vendor-advisory

Sources

CVE List CVE-2024-45739
NVD CVE-2024-45739

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary