Detections
Analytics
Splunk 4.x < 4.1.3 404 Response XSS
medium Nessus Plugin ID 47620
Language:
Synopsis
The remote web server contains an application that is affected by a cross-site scripting vulnerability.Description
The version of Splunk Web hosted on the remote web server is affected by a cross-site scripting vulnerability due to a failure to sanitize the contents of the HTTP 'Referer' header before using it in HTTP error 404 messages. An unauthenticated, remote attacker can exploit this issue to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.Note that exploitation is only confirmed as valid in Internet Explorer since Firefox escapes the special characters '<' and '>' when rendering a link.
Solution
Upgrade to Splunk 4.1.3 or later.See Also
Plugin Details
Severity: Medium
ID: 47620
File Name: splunk_413_404error_xss.nasl
Version: 1.13
Type: remote
Family: CGI abuses : XSS
Published: 7/7/2010
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:splunk:splunk
Required KB Items: installed_sw/Splunk
Exploit Ease: No exploit is required
Exploited by Nessus: true
Patch Publication Date: 6/7/2010
Vulnerability Publication Date: 6/7/2010
Reference Information
CVE: CVE-2010-2429
BID: 73536