Splunk Enterprise and Splunk Lite Cross Site Scripting and HTML Injection Vulnerabilities

Bugtraq ID:	100355
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 16 2017 12:00AM
Updated:	Aug 16 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Splunk Splunk Enterprise 6.6.2 Splunk Splunk Enterprise 6.6.1 Splunk Splunk Enterprise 6.6 Splunk Light 6.6.2 Splunk Light 6.6.1 Splunk Light 6.6
Not Vulnerable:	Splunk Splunk Enterprise 6.6.3 Splunk Light 6.6.3

Splunk Enterprise and Splunk Lite Cross Site Scripting and HTML Injection Vulnerabilities

Splunk Enterprise and Splunk Lite are prone to a cross-site scripting vulnerability and an HTML-injection vulnerability.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

The following versions are affected:

Splunk Enterprise 6.6.x prior to 6.6.3 are vulnerable.
Splunk Light 6.6.x prior to 6.6.3 are vulnerable.

Splunk Enterprise and Splunk Lite Cross Site Scripting and HTML Injection Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Splunk Enterprise and Splunk Lite Cross Site Scripting and HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Splunk Enterprise and Splunk Lite Cross Site Scripting and HTML Injection Vulnerabilities

References:

• Splunk Homepage (Splunk)
  
• Splunk Enterprise 6.6.3 and Splunk Light 6.6.3 address multiple vulnerabilities (Splunk)