CVE-2014-2578: XSS
Published Apr 2, 2014
·Updated
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk before 5.0.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
8 affected components
Splunk splunk<=5.0.7
Splunk splunk=5.0
Splunk splunk=5.0.1
Splunk splunk=5.0.2
Splunk splunk=5.0.3
Splunk splunk=5.0.4
Splunk splunk=5.0.5
Splunk splunk=5.0.6
Event History
Apr 2, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·04:06 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2578?
CVE-2014-2578 has a moderate severity rating due to its cross-site scripting vulnerability that could allow remote attack vectors.
2
How do I fix CVE-2014-2578?
To fix CVE-2014-2578, upgrade Splunk to version 5.0.8 or later.
3
What impact does CVE-2014-2578 have on users?
CVE-2014-2578 can allow attackers to inject arbitrary web scripts or HTML, potentially compromising user data and session integrity.
4
Is CVE-2014-2578 present in all Splunk versions?
CVE-2014-2578 affects Splunk versions prior to 5.0.8, specifically versions 5.0 through 5.0.7 and any earlier releases.
5
Can attackers exploit CVE-2014-2578 without authentication?
Yes, CVE-2014-2578 can be exploited by remote attackers without requiring authentication, posing significant risk.