CVE report
CVE-2024-36991high
Splunk Enterprise - Local File Inclusion
Events 90d
326
Distinct IPs
59
Severity
high
CISA KEV
Not listed
Detection signature
An event counts toward CVE-2024-36991 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /en-US/login
- · /en-US/modules/messaging/C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../C:../Windows/win.ini
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 108 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2024-36991
- 178.16.53.233108 eventsNetherlands· Omegatech LTD
- 178.16.54.6248 eventsNetherlands· Omegatech LTD
- 37.77.150.1038 eventsRussia· Proton66 OOO
- 141.98.80.5730 eventsPanama· NForce Entertainment B.V.
- 193.24.211.10311 eventsGermany· Data Campus Limited
- 23.95.117.25310 eventsUnited States· HostPapa
- 213.209.159.7410 eventsTaiwan· Feo Prest SRL
- 70.182.140.1538 eventsUnited States· Cox Communications Inc.
- 91.92.243.1476 eventsUnited States· Omegatech LTD
- 192.3.194.394 eventsUnited States· HostPapa
- 100.48.18.2244 eventsUnited States
- 45.225.135.1532 eventsPanama· RACK SPHERE HOSTING S.A.
- 173.255.197.361 eventsUnited States
- 167.172.223.631 eventsUnited States
- 105.105.251.631 eventsAlgeria· Telecom Algeria
- 137.184.145.1171 eventsUnited States
- 176.110.134.831 eventsRussia· TeleCentr Ltd.
- 45.225.135.1541 eventsPanama· RACK SPHERE HOSTING S.A.
- 45.7.165.1421 eventsBrazil· REAL LIFE COMERCIO E SERVICOS LTDA
- 64.227.3.2021 eventsUnited States
- 78.37.41.481 eventsRussia· Rostelecom
- 171.97.46.411 eventsThailand· True Online
- 39.34.129.71 eventsPakistan· Connect Communications
- 83.110.131.691 eventsUnited Arab Emirates· Emirates Telecommunications Group Company (etisalat Group) Pjsc
- 186.56.31.2301 eventsArgentina· Telefonica de Argentina
- 14.190.11.2361 eventsVietnam· VNPT Corp
- 45.225.135.301 eventsPanama· RACK SPHERE HOSTING S.A.
- 191.112.94.1201 eventsChile· TELEFONICA CHILE S.A.
- 167.99.172.661 eventsUnited States
- 189.226.109.1041 eventsMexico· UNINET
Top networks the attempts come from
- AS202412 Omegatech LTD3 IPs · 162 ev
- AS198953 Proton66 OOO1 IPs · 38 ev
- AS43350 NForce Entertainment B.V.1 IPs · 30 ev
- AS36352 HostPapa2 IPs · 14 ev
- AS215929 Data Campus Limited1 IPs · 11 ev
- AS208137 Feo Prest SRL1 IPs · 10 ev
- AS22773 Cox Communications Inc.1 IPs · 8 ev
- AS14061 DigitalOcean, LLC6 IPs · 6 ev
- AS63949 Akamai Connected Cloud5 IPs · 5 ev
- AS64107 RACK SPHERE HOSTING S.A.3 IPs · 4 ev
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
ja4h: ge11nn0400_c3abebcf3d28ja4h: ge11nn0100_4740ae6347b0ja4h: ge11nn09en_d4346e7f474fja4h: ge11nn0200_f24fcf356134ja4h: ge11nn0400_9c3956fad5daja4h: ge11nn0400_ef4d07580f66ja4: t13i131300_f57a46bbacb6_3b244d8fbcc8ja4: t12i210600_76e208dd3e22_2dae41c691ecja4: t13i1811h1_85036bcba153_d41ae481755eja4: t10i070500_c50f5591e341_950472255fe9ja4: t13i131000_f57a46bbacb6_ab7e3b40a677
Sample request paths observed
- /rdweb/Pages/en-US/login.aspx/
- /rdweb/Pages/en-US/login.aspx
- /RDWeb/Pages/en-US/login.aspx