The vulnerability in the Splunk Web interface of the Splunk Enterprise operating analysis platform allows a perpetrator to carry out cross-site scripting attacks.

🗓️ 07 Sep 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

A Splunk Web vulnerability enables cross-site scripting via the /app/search/table endpoint due to insufficient page structure protection.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2023-40592	30 Aug 202320:12	–	circl
CNNVD	Splunk 跨站脚本漏洞	30 Aug 202300:00	–	cnnvd
CVE	CVE-2023-40592	30 Aug 202316:19	–	cve
Cvelist	CVE-2023-40592 Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint	30 Aug 202316:19	–	cvelist
EUVD	EUVD-2023-45150	3 Oct 202520:07	–	euvd
NVD	CVE-2023-40592	30 Aug 202317:15	–	nvd
OSV	CVE-2023-40592	30 Aug 202317:15	–	osv
Prion	Cross site scripting	30 Aug 202317:15	–	prion
Positive Technologies	PT-2023-4795 · Splunk · Splunk Enterprise	16 Aug 202300:00	–	ptsecurity
Tenable Nessus	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0801)	30 Aug 202300:00	–	nessus

Vulners

Node

splunk splunk_enterpriseRange8.2.0–8.2.12

OR

splunk splunk_enterpriseRange9.0.0–9.0.6

OR

splunk splunk_enterpriseMatch9.1.0

OR

splunk splunk_cloud_platformRange≤9.0.2305.100

Source	Link
vuldb	www.vuldb.com/ru/
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2023090417
advisory	www.advisory.splunk.com/advisories/SVD-2023-0801
web	www.web.nvd.nist.gov/view/vuln/detail

07 Sep 2023 00:00Current

6Medium risk

Vulners AI Score6

CVSS 38.4

CVSS 28.5

EPSS0.00541

Splunk Web cross site scripting search table endpoint page structure protection vulnerability