Test ID:	1.3.6.1.4.1.25623.1.0.106714
Category:	Web application abuses
Title:	Splunk Light Multiple XSS Vulnerabilities
Summary:	Splunk Light is prone to multiple cross-site scripting vulnerabilities.
Description:	Summary: Splunk Light is prone to multiple cross-site scripting vulnerabilities. Vulnerability Insight: Splunk Light is prone to multiple cross-site scripting vulnerabilities: - Splunk Light is affected by a vulnerability that allows an attacker to inject and store arbitrary script. However, the attacker has to be authenticated in Splunk web before exploiting this vulnerability. - Splunk Light is affected by a vulnerability that could allow a remote attacker to obtain logged-in username and Splunk version-related information via JavaScript. Affected Software/OS: Splunk Light prior to version 6.5.2 Solution: Update to version 6.5.2 or later. CVSS Score: 3.5 CVSS Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-5607 BugTraq ID: 97265 http://www.securityfocus.com/bid/97265 BugTraq ID: 97286 http://www.securityfocus.com/bid/97286 Bugtraq: 20170401 Splunk Enterprise Information Theft CVE-2017-5607 (Google Search) http://www.securityfocus.com/archive/1/540346/100/0/threaded https://www.exploit-db.com/exploits/41779/ http://seclists.org/fulldisclosure/2017/Mar/89 http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt http://www.securitytracker.com/id/1038170
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.