Spoofing attack in Splunk Enterprise and Splunk Light - #VU7211
Published: June 27, 2017 / Updated: October 22, 2018
Vulnerability identifier: #VU7211
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to improper validation of user-supplied input. A remote attacker can create a specially crafted web page, trick the victim into visiting it and conduct URL spoofing attacks.
Successful exploitation of the vulnerability results in error message content spoofing.
Affected software
Splunk Enterprise
Splunk Light
Splunk Light
Remediation
Update Splunk Enterprise to version 5.0.19, 6.0.15, 6.1.14, 6.2.14, 6.3.11, 6.4.7, 6.5.3.
Update Splunk Light to version 6.5.3.
Update Splunk Light to version 6.5.3.
Splunk Enterprise - addressed in versions 5.0.19, 6.0.15, 6.1.14, 6.2.14, 6.3.11, 6.4.7, 6.5.3
Splunk Light - update to 6.5.3
Splunk Light - update to 6.5.3