Vulnerability Report

CVE-2017-5607

Title: Splunk Information Disclosure

Information Disclosure

Proof Of Concept

PoC Available for CVE-2017-5607

CWE Category CWE-200

Published Date Apr 10, 2017

Modified Date Jun 17, 2026

Exploit Status Available

Score 3.5 CVSS v3.0

Exploit Probability (EPSS)

5.85%

Vulnerability Summary

CVE-2017-5607: Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.

Impacted Vendors

splunk 1

jenkins 1

Reference Links

http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt http://seclists.org/fulldisclosure/2017/Mar/89 http://www.securityfocus.com/archive/1/540346/100/0/threaded http://www.securityfocus.com/bid/97265 http://www.securityfocus.com/bid/97286 http://www.securitytracker.com/id/1038170 https://www.exploit-db.com/exploits/41779/ https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607 http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt http://seclists.org/fulldisclosure/2017/Mar/89 http://www.securityfocus.com/archive/1/540346/100/0/threaded http://www.securityfocus.com/bid/97265 http://www.securityfocus.com/bid/97286 http://www.securitytracker.com/id/1038170 https://www.exploit-db.com/exploits/41779/ https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607

CVSS v3.0

Source Entity [email protected]

Severity LOW

3.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CVSS v2.0

Source Entity [email protected]

Severity LOW

3.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:S/C:P/I:N/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns