CVE-2015-6515: XSS

Published Aug 18, 2015

Updated

Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk Enterprise 6.2.x before 6.2.4, 6.1.x before 6.1.8, 6.0.x before 6.0.9, and 5.0.x before 5.0.13 and Splunk Light 6.2.x before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via a header.

Affected Software

38 affected components

Splunk splunk=5.0.0

Splunk splunk=5.0.1

Splunk splunk=5.0.2

Splunk splunk=5.0.3

Splunk splunk=5.0.4

Splunk splunk=5.0.5

Splunk splunk=5.0.6

Splunk splunk=5.0.7

Splunk splunk=5.0.8

Splunk splunk=5.0.9

Splunk splunk=5.0.10

Splunk splunk=5.0.11

Splunk splunk=5.0.12

Splunk splunk=6.0.0

Splunk splunk=6.0.1

Splunk splunk=6.0.2

Splunk splunk=6.0.3

Splunk splunk=6.0.4

Splunk splunk=6.0.5

Splunk splunk=6.0.6

Splunk splunk=6.0.7

Splunk splunk=6.0.8

Splunk splunk=6.1.0

Splunk splunk=6.1.1

Splunk splunk=6.1.2

Splunk splunk=6.1.3

Splunk splunk=6.1.4

Splunk splunk=6.1.5

Splunk splunk=6.1.6

Splunk splunk=6.1.7

Splunk splunk=6.2.0

Splunk splunk=6.2.1

Splunk splunk=6.2.2

Splunk splunk=6.2.3

Event History

Aug 18, 2015

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6515?

CVE-2015-6515 is considered a medium severity vulnerability due to the potential for remote cross-site scripting attacks.

How do I fix CVE-2015-6515?

To fix CVE-2015-6515, update Splunk to version 6.2.4 or later, or to 6.1.8, 6.0.9, or 5.0.13 for the respective older versions.

What types of attacks can be executed through CVE-2015-6515?

CVE-2015-6515 allows attackers to inject arbitrary web scripts or HTML through manipulated headers.

Which versions of Splunk are affected by CVE-2015-6515?

CVE-2015-6515 affects Splunk Enterprise versions prior to 6.2.4, 6.1.8, 6.0.9, and 5.0.13, as well as Splunk Light prior to 6.2.4.

Is CVE-2015-6515 easily exploitable?

CVE-2015-6515 is easily exploitable as it allows remote attackers to execute XSS attacks without requiring authentication.