CVE-2023-32715
Medium
Description
In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will.
SeverityMedium
CVSS4.7
Exploit probability—
ProductSplunk App For Lookup File Editing
PublishedJun 1, 2023
First seenJun 1, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- splunk splunk_app_for_lookup_file_editing4.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| splunk splunk_app_for_lookup_file_editing | v < 4.0.1 | 4.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.