CVEvulnerability
CVE-2017-5607
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2017-04-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 3.5 LOW — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.
Affected configurations
• splunk splunk (<= 6.5.1)
• splunk splunk (>= 5.0.0 < 5.0.18)
• splunk splunk (>= 6.0.0 < 6.0.14)
• splunk splunk (>= 6.1.0 < 6.1.13)
• splunk splunk (>= 6.2.0 < 6.2.13.1)
• splunk splunk (>= 6.3.0 < 6.3.10)
• splunk splunk (>= 6.4.0 < 6.4.6)
• splunk splunk (>= 6.5.0 < 6.5.3)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/Mar/89 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/archive/1/540346/100/0/threaded Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/97265 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/97286 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038170 Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/41779/ Exploit, Third Party Advisory, VDB Entry
- https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607 Vendor Advisory
- http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/Mar/89 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/archive/1/540346/100/0/threaded Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/97265 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/97286 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038170 Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/41779/ Exploit, Third Party Advisory, VDB Entry
- https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607 Vendor Advisory