Splunk の splunk app for lookup file editing におけるクロスサイトスクリプティングの脆弱性
| Title |
Splunk の splunk app for lookup file editing におけるクロスサイトスクリプティングの脆弱性
|
| Summary |
Splunk の splunk app for lookup file editing には、クロスサイトスクリプティングの脆弱性が存在します。
|
| Possible impacts |
情報を取得される、および情報を改ざんされる可能性があります。 |
| Solution |
ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。 |
| Publication Date |
June 1, 2023, midnight |
| Registration Date |
Nov. 24, 2023, 5:10 p.m. |
| Last Update |
Nov. 24, 2023, 5:10 p.m. |
|
CVSS3.0 : 警告
|
| Score |
6.1
|
| Vector |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected System
| Splunk |
|
splunk app for lookup file editing 4.0.1 未満
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
その他
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2023年11月24日]
掲載 |
Nov. 24, 2023, 5:10 p.m. |
NVD Vulnerability Information
CVE-2023-32715
| Summary |
In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will.
|
| Publication Date |
June 2, 2023, 2:15 a.m. |
| Registration Date |
June 2, 2023, 10 a.m. |
| Last Update |
Nov. 21, 2024, 5:03 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:splunk:splunk_app_for_lookup_file_editing:*:*:*:*:*:*:*:* |
|
|
|
4.0.1 |
Related information, measures and tools
Common Vulnerabilities List