CVE-2016-4858

Опубликовано: 12 мая 2017

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Ссылки

https://jvn.jp/en/jp/JVN71462075/index.html
Third Party Advisory
VDB Entry
https://www.splunk.com/view/SP-CAAAPN9
Vendor Advisory
https://jvn.jp/en/jp/JVN71462075/index.html
Third Party Advisory
VDB Entry
https://www.splunk.com/view/SP-CAAAPN9
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:splunk:splunk:*:*:*:*:light:*:*:*

Версия до 6.4.2 (включая)

cpe:2.3:a:splunk:splunk:5.0.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.5:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.6:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.7:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.8:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.9:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.10:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.11:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.12:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.13:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.14:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:5.0.15:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.5:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.6:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.7:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.8:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.9:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.10:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.0.11:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.5:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.6:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.7:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.8:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.9:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.1.10:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.5:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.6:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.7:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.8:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.9:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.2.10:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.5:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.4.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.4.1:*:*:*:enterprise:*:*:*

EPSS

Процентиль: 39%

0.00176

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-jqwm-h8cf-c265