Description (CNA)
In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Splunk / Splunk Enterprise | affected 9.0 before 9.0.4 |
| Splunk / Splunk Cloud Platform | affected - before 9.0.2209.3 |
CWE
CWE-79
References
- https://advisory.splunk.com/advisories/SVD-2023-0202
- https://research.splunk.com/application/ce6e1268-e01c-4df2-a617-0f034ed49a43/
ADP enrichment
No English description supplied.