CVE-2017-12572

Опубликовано: 05 авг. 2017

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.

Ссылки

https://www.splunk.com/view/SP-CAAAPYC
Vendor Advisory
https://www.splunk.com/view/SP-CAAAPYC
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:splunk:splunk:6.3.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.5:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.6:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.7:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.3.8:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.4.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.4.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.4.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.4.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.4.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.4.5:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.5.0:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.5.0:*:*:*:light:*:*:*

cpe:2.3:a:splunk:splunk:6.5.1:*:*:*:enterprise:*:*:*

cpe:2.3:a:splunk:splunk:6.5.1:*:*:*:light:*:*:*

EPSS

Процентиль: 49%

0.0026

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-p949-mvf5-2jgv