In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘module’ tag’.
References
Link | Resource |
---|---|
https://advisory.splunk.com/advisories/SVD-2023-0203 | Vendor Advisory |
https://research.splunk.com/application/9ac2bfea-a234-4a18-9d37-6d747e85c2e4 | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
25 Oct 2023, 18:17
Type | Values Removed | Values Added |
---|---|---|
Summary | In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, a View allows for Cross-Site Scripting (XSS) in an extensible mark-up language (XML) View through the ‘layoutPanel’ attribute in the ‘module’ tag’. |
23 Feb 2023, 15:17
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://research.splunk.com/application/9ac2bfea-a234-4a18-9d37-6d747e85c2e4 - Exploit, Vendor Advisory | |
References | (MISC) https://advisory.splunk.com/advisories/SVD-2023-0203 - Vendor Advisory | |
First Time |
Splunk splunk
Splunk splunk Cloud Platform Splunk |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
CWE | CWE-79 | |
CPE | cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:* |
14 Feb 2023, 18:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-02-14 18:15
Updated : 2024-04-10 01:15
NVD link : CVE-2023-22933
Mitre link : CVE-2023-22933
CVE.ORG link : CVE-2023-22933
JSON object : View
Products Affected
splunk
- splunk
- splunk_cloud_platform
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')