JVN#71462075: Splunk Enterprise and Splunk Lite vulnerable to cross-site scripting

Splunk Enterprise and Splunk Lite contain a stored cross-site scripting vulnerability (CWE-79).

Impact

An arbitrary script may be executed on the user’s web browser by an attacker who can log-in to the system as an administrator.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• Splunk Enterprise 6.3.x prior to 6.3.5
• Splunk Light 6.3.x prior to 6.3.5