Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.
References
| Link | Resource |
|---|---|
| https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607 | Vendor Advisory |
| https://www.exploit-db.com/exploits/41779/ | Exploit Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1038170 | Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/97286 | Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/97265 | Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2017/Mar/89 | Exploit Mailing List Third Party Advisory |
| http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt | Exploit Third Party Advisory |
| http://www.securityfocus.com/archive/1/540346/100/0/threaded | Exploit VDB Entry Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
No history.
Information
Published : 2017-04-10 15:59
Updated : 2019-03-20 19:23
NVD link : CVE-2017-5607
Mitre link : CVE-2017-5607
JSON object : View
Products Affected
splunk
- splunk
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor