Lucene search

JpcertCVE-2016-4858

HistoryMay 12, 2017 - 6:29 p.m.

CVE-2016-4858

2017-05-1218:29:00

CWE-79

jpcert

web.nvd.nist.gov

cve-2016-4858

cross-site scripting

xss

splunk enterprise

security vulnerability

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

28.6%

JSON

Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected configurations

Nvd

Vulners

Node

splunksplunkRange≤6.4.2light

splunksplunkMatch5.0.0enterprise

splunksplunkMatch5.0.1enterprise

splunksplunkMatch5.0.2enterprise

splunksplunkMatch5.0.3enterprise

splunksplunkMatch5.0.4enterprise

splunksplunkMatch5.0.5enterprise

splunksplunkMatch5.0.6enterprise

splunksplunkMatch5.0.7enterprise

splunksplunkMatch5.0.8enterprise

splunksplunkMatch5.0.9enterprise

splunksplunkMatch5.0.10enterprise

splunksplunkMatch5.0.11enterprise

splunksplunkMatch5.0.12enterprise

splunksplunkMatch5.0.13enterprise

splunksplunkMatch5.0.14enterprise

splunksplunkMatch5.0.15enterprise

splunksplunkMatch6.0.0enterprise

splunksplunkMatch6.0.1enterprise

splunksplunkMatch6.0.2enterprise

splunksplunkMatch6.0.3enterprise

splunksplunkMatch6.0.4enterprise

splunksplunkMatch6.0.5enterprise

splunksplunkMatch6.0.6enterprise

splunksplunkMatch6.0.7enterprise

splunksplunkMatch6.0.8enterprise

splunksplunkMatch6.0.9enterprise

splunksplunkMatch6.0.10enterprise

splunksplunkMatch6.0.11enterprise

splunksplunkMatch6.1.0enterprise

splunksplunkMatch6.1.1enterprise

splunksplunkMatch6.1.2enterprise

splunksplunkMatch6.1.3enterprise

splunksplunkMatch6.1.4enterprise

splunksplunkMatch6.1.5enterprise

splunksplunkMatch6.1.6enterprise

splunksplunkMatch6.1.7enterprise

splunksplunkMatch6.1.8enterprise

splunksplunkMatch6.1.9enterprise

splunksplunkMatch6.1.10enterprise

splunksplunkMatch6.2.0enterprise

splunksplunkMatch6.2.1enterprise

splunksplunkMatch6.2.2enterprise

splunksplunkMatch6.2.3enterprise

splunksplunkMatch6.2.4enterprise

splunksplunkMatch6.2.5enterprise

splunksplunkMatch6.2.6enterprise

splunksplunkMatch6.2.7enterprise

splunksplunkMatch6.2.8enterprise

splunksplunkMatch6.2.9enterprise

splunksplunkMatch6.2.10enterprise

splunksplunkMatch6.3.0enterprise

splunksplunkMatch6.3.1enterprise

splunksplunkMatch6.3.2enterprise

splunksplunkMatch6.3.3enterprise

splunksplunkMatch6.3.4enterprise

splunksplunkMatch6.3.5enterprise

splunksplunkMatch6.4.0enterprise

splunksplunkMatch6.4.1enterprise

VendorProductVersionCPE
splunksplunk5.0.10cpe:/a:splunk:splunk:5.0.10::enterprise:
splunksplunk6.3.0cpe:/a:splunk:splunk:6.3.0::enterprise:
splunksplunk6.1.10cpe:/a:splunk:splunk:6.1.10::enterprise:
splunksplunk6.3.5cpe:/a:splunk:splunk:6.3.5::enterprise:
splunksplunk6.0.8cpe:/a:splunk:splunk:6.0.8::enterprise:
splunksplunk6.1.4cpe:/a:splunk:splunk:6.1.4::enterprise:
splunksplunk6.3.3cpe:/a:splunk:splunk:6.3.3::enterprise:
splunksplunk6.0.6cpe:/a:splunk:splunk:6.0.6::enterprise:
splunksplunk5.0.3cpe:/a:splunk:splunk:5.0.3::enterprise:
splunksplunk6.1.7cpe:/a:splunk:splunk:6.1.7::enterprise:

Vendor	Product	Version	CPE
splunk	splunk	5.0.10	cpe:/a:splunk:splunk:5.0.10::enterprise:
splunk	splunk	6.3.0	cpe:/a:splunk:splunk:6.3.0::enterprise:
splunk	splunk	6.1.10	cpe:/a:splunk:splunk:6.1.10::enterprise:
splunk	splunk	6.3.5	cpe:/a:splunk:splunk:6.3.5::enterprise:
splunk	splunk	6.0.8	cpe:/a:splunk:splunk:6.0.8::enterprise:
splunk	splunk	6.1.4	cpe:/a:splunk:splunk:6.1.4::enterprise:
splunk	splunk	6.3.3	cpe:/a:splunk:splunk:6.3.3::enterprise:
splunk	splunk	6.0.6	cpe:/a:splunk:splunk:6.0.6::enterprise:
splunk	splunk	5.0.3	cpe:/a:splunk:splunk:5.0.3::enterprise:
splunk	splunk	6.1.7	cpe:/a:splunk:splunk:6.1.7::enterprise:

Rows per page:

1-10 of 591

CNA Affected

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "6.4.x prior to 6.4.2"
      },
      {
        "status": "affected",
        "version": "6.3.x prior to 6.3.6"
      },
      {
        "status": "affected",
        "version": "6.2.x prior to 6.2.10"
      },
      {
        "status": "affected",
        "version": "6.1.x prior to 6.1.11"
      },
      {
        "status": "affected",
        "version": "6.0.x prior to 6.0.12"
      },
      {
        "status": "affected",
        "version": "5.0.x prior to 5.0.16"
      }
    ]
  },
  {
    "product": "Splunk Light",
    "vendor": "Splunk Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 6.4.2"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN71462075/index.html

www.splunk.com/view/SP-CAAAPN9

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

28.6%

JSON

Related for CVE-2016-4858