CVE-2017-12572: XSS
First published: Sat Aug 05 2017(Updated: )
Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk | =6.3.0 | |
| Splunk | =6.3.1 | |
| Splunk | =6.3.2 | |
| Splunk | =6.3.3 | |
| Splunk | =6.3.4 | |
| Splunk | =6.3.5 | |
| Splunk | =6.3.6 | |
| Splunk | =6.3.7 | |
| Splunk | =6.3.8 | |
| Splunk | =6.4.0 | |
| Splunk | =6.4.1 | |
| Splunk | =6.4.2 | |
| Splunk | =6.4.3 | |
| Splunk | =6.4.4 | |
| Splunk | =6.4.5 | |
| Splunk | =6.5.0 | |
| Splunk | =6.5.0 | |
| Splunk | =6.5.1 | |
| Splunk | =6.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-12572?
CVE-2017-12572 is considered to have a moderate severity level due to the requirement of administrative access for exploitation.
How do I fix CVE-2017-12572?
To fix CVE-2017-12572, upgrade Splunk Enterprise to versions 6.5.2 or later, 6.4.6 or later, or 6.3.9 or later.
What type of vulnerability is CVE-2017-12572?
CVE-2017-12572 is classified as a Persistent Cross-Site Scripting (XSS) vulnerability.
Which versions of Splunk are affected by CVE-2017-12572?
CVE-2017-12572 affects Splunk Enterprise versions 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9, as well as Splunk Light before 6.5.2.
Is administrative access needed to exploit CVE-2017-12572?
Yes, exploitation of CVE-2017-12572 requires administrative access to the affected versions of Splunk.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/splunk
- canonical/splunk
- version/splunk/6.3.0
- version/splunk/6.3.1
- version/splunk/6.3.2
- version/splunk/6.3.3
- version/splunk/6.3.4
- version/splunk/6.3.5
- version/splunk/6.3.6
- version/splunk/6.3.7
- version/splunk/6.3.8
- version/splunk/6.4.0
- version/splunk/6.4.1
- version/splunk/6.4.2
- version/splunk/6.4.3
- version/splunk/6.4.4
- version/splunk/6.4.5
- version/splunk/6.5.0
- version/splunk/6.5.1