Lucene search

[email protected]CVE-2017-5607

HistoryApr 10, 2017 - 3:59 p.m.

CVE-2017-5607

2017-04-1015:59:00

CWE-200

[email protected]

web.nvd.nist.gov

splunk

splunk enterprise

splunk light

cve-2017-5607

security vulnerability

information disclosure

3.5 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

3.6 Low

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

0.01 Low

EPSS

Percentile

83.0%

JSON

Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.

CPENameOperatorVersion
splunk:splunksplunkle6.5.1
splunk:splunksplunklt6.5.3
splunk:splunksplunklt6.3.10
splunk:splunksplunklt6.0.14
splunk:splunksplunklt6.1.13
splunk:splunksplunklt6.4.6
splunk:splunksplunklt5.0.18
splunk:splunksplunklt6.2.13.1

CPE	Name	Operator	Version
splunk:splunk	splunk	le	6.5.1
splunk:splunk	splunk	lt	6.5.3
splunk:splunk	splunk	lt	6.3.10
splunk:splunk	splunk	lt	6.0.14
splunk:splunk	splunk	lt	6.1.13
splunk:splunk	splunk	lt	6.4.6
splunk:splunk	splunk	lt	5.0.18
splunk:splunk	splunk	lt	6.2.13.1