CVE-2016-4858

2017-05-1218:00:00

jpcert

www.cve.org

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

28.6%

JSON

Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CNA Affected

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "6.4.x prior to 6.4.2"
      },
      {
        "status": "affected",
        "version": "6.3.x prior to 6.3.6"
      },
      {
        "status": "affected",
        "version": "6.2.x prior to 6.2.10"
      },
      {
        "status": "affected",
        "version": "6.1.x prior to 6.1.11"
      },
      {
        "status": "affected",
        "version": "6.0.x prior to 6.0.12"
      },
      {
        "status": "affected",
        "version": "5.0.x prior to 5.0.16"
      }
    ]
  },
  {
    "product": "Splunk Light",
    "vendor": "Splunk Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 6.4.2"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN71462075/index.html

www.splunk.com/view/SP-CAAAPN9