The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0301 advisory.

  - In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes     authentication tokens during the token validation process. This exposure happens when either Splunk     Enterprise runs in debug mode or the JsonWebToken component has been configured to log its activity at the     DEBUG logging level. (CVE-2024-29945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Splunk Enterprise 9.0.0 < 9.0.9, 9.1.0 < 9.1.4, 9.2.0 < 9.2.1 (SVD-2024-0301)

high Nessus Plugin ID 192633

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Jul 12, 2024, 5:55 PM IAVM reference Plugin Feed: 202407121755
Version 1.2 Apr 26, 2024, 10:39 PM Plugin metadata Plugin Feed: 202404262239
Version 1.1 Mar 29, 2024, 11:43 AM IAVM reference STIG Severity (set to "I") Plugin Feed: 202403291143
Version 1.0 Mar 28, 2024, 12:14 AM New Plugin Feed: 202403280014