CVE-2017-5607
First published: Mon Apr 10 2017(Updated: )
Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk Splunk | <=6.5.1 | |
| Splunk Splunk | >=5.0.0<5.0.18 | |
| Splunk Splunk | >=6.0.0<6.0.14 | |
| Splunk Splunk | >=6.1.0<6.1.13 | |
| Splunk Splunk | >=6.2.0<6.2.13.1 | |
| Splunk Splunk | >=6.3.0<6.3.10 | |
| Splunk Splunk | >=6.4.0<6.4.6 | |
| Splunk Splunk | >=6.5.0<6.5.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt
- http://seclists.org/fulldisclosure/2017/Mar/89
- http://www.securityfocus.com/archive/1/540346/100/0/threaded
- http://www.securityfocus.com/bid/97265
- http://www.securityfocus.com/bid/97286
- http://www.securitytracker.com/id/1038170
- https://www.exploit-db.com/exploits/41779/
- https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607
Frequently Asked Questions
What is the severity of CVE-2017-5607?
The severity of CVE-2017-5607 is classified as low with a score of 3.5.
How do I fix CVE-2017-5607?
To fix CVE-2017-5607, you should upgrade to the latest version of Splunk that is not vulnerable.
Which versions of Splunk are affected by CVE-2017-5607?
CVE-2017-5607 affects Splunk Enterprise versions before 5.0.18, 6.0.14, 6.1.13, 6.2.13.1, 6.3.10, 6.4.6, 6.5.3 and Splunk Light before 6.5.2.
What type of vulnerability is CVE-2017-5607?
CVE-2017-5607 is classified as an information theft vulnerability.
Can CVE-2017-5607 be exploited remotely?
Yes, CVE-2017-5607 can potentially be exploited by remote attackers.
- collector/nvd-index
- vendor/splunk
- product/splunk
- canonical/splunk splunk