header-logo
Suggest Exploit
vendor:
Splunk
by:
Unknown
5.5
CVSS
MEDIUM
Cross-Site Scripting (XSS)
79
CWE
Product Name: Splunk
Affected Version From: 4.2.2002
Affected Version To: 4.2.2002
Patch Exists: NO
Related CWE:
CPE: a:splunk:splunk:4.2.2
Metasploit:
Other Scripts:
Platforms Tested:
2020

Cross-Site Scripting Vulnerability in Splunk

The vulnerability exists in Splunk due to insufficient sanitization of user-supplied data. An attacker can exploit this vulnerability to execute arbitrary HTML and script code in the context of the affected site, potentially leading to the theft of authentication credentials and other attacks.

Mitigation:

Upgrade to a non-vulnerable version of Splunk. Apply patches or updates provided by the vendor.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/50296/info

Splunk is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Splunk versions 4.2.2 and prior are vulnerable. 

http://www.example.com/en-US/prototype/segmentation_performance?lines=2&depth=2&segment=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&element=aaa&attribute=aaa&segmentation=flattened

Navigation

Suggest Exploit

Services By CQR