VulnerabilityDeferred

CVE-2024-35291

Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16.

MEDIUM 6.1EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.26% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: vultures@jpcert.or.jp

References

https://jvn.jp/en/jp/JVN56781258/
https://splunkbase.splunk.com/app/4353
https://jvn.jp/en/jp/JVN56781258/
https://splunkbase.splunk.com/app/4353

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.