Cross-Site Scripting Vulnerability in Splunk Enterprise and Splunk Light
CVE-2016-4856
4.8MEDIUM
Summary
A cross-site scripting vulnerability exists in Splunk Enterprise and Splunk Light, allowing users with administrator rights to inject arbitrary web scripts or HTML. This vulnerability affects versions prior to 6.3.5 and can be exploited through unspecified vectors, potentially enabling attackers to execute malicious scripts in the context of users’ browsers.
Affected Version(s)
Splunk Enterprise 6.3.x prior to 6.3.5
Splunk Light 6.3.x prior to 6.3.5
References
CVSS V3.1
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved