Summary
This host is installed with Splunk and
is prone to cross-site scripting vulnerability.
Impact
Successful exploitation will allow
attacker to execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Impact Level: Application
Solution
Upgrade to version 6.1.3 or later,
For updates refer to http://www.splunk.com/download
Insight
Input passed via the Referer header
in HTTP GET is not properly sanitized before being returned to the user
Affected
Splunk Version 6.1.x before 6.1.3
Detection
Send a crafted data via HTTP GET
request and check whether it is able to read cookie or not.
References
Severity
Classification
-
CVE CVE-2014-5198 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- AMSI 'file' Parameter Directory Traversal Vulnerability
- APC PowerChute Network Shutdown HTTP Response Splitting Vulnerability
- Apache ActiveMQ 'admin/queueBrowse' Cross Site Scripting Vulnerability
- 1024 CMS 1.1.0 Beta 'force_download.php' Local File Include Vulnerability
- Apache Web Server Configuration File Environment Variable Local Buffer Overflow Vulnerability