Attackers can siphon data from Splunk Enterprise if an authenticated user visits a malicious webpage
50
CVE-2017-5607
PoC ×4—CVSS 3.0
3.5 low
EPSS
6%p93
Published
()
Modified
Description
Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.
- Vendors
- splunk
- Products
- splunk
- Weakness
- CWE-200
- Vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N