# CVE-2024-36991

In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.

- Page: https://www.vulneraibility.com/cve/CVE-2024-36991
- CVSS: 7.5
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 13.01% (percentile 96.4)
- Unvetted proof-of-concept code on GitHub: 10 GitHub proofs of concept · 1 Nuclei template (first 2024-07-06)
- CISA SSVC: exploitation poc, automatable yes, technical impact partial (assessed 2024-07-01)
- Weakness: CWE-35
- Published: 2024-07-01

## Affected versions

- Splunk Splunk Enterprise: affected >= 9.2 and < 9.2.2; >= 9.1 and < 9.1.5; >= 9.0 and < 9.0.10

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://advisory.splunk.com/advisories/SVD-2024-0711
- [other] https://research.splunk.com/application/e7c2b064-524e-4d65-8002-efce808567aa

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.