UpHeron
All vulnerabilities

Servers and applications

CVE-2017-5607

Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.

Severity
Low 3.5
Published
10 Apr 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.0.14, 6.1.13, 6.2.13.1, 6.3.10, 6.4.6, 6.5.3
Exploit chance
5.9% in the next 30 daysHigher than 93% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Information exposure (CWE-200)
Attack
Over the network · Needs a user account · Needs someone to click or open something
Attacker can
Read some data
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
Splunk EnterpriseServers and applications · cpe:a:splunk:splunk
  • From 6.5.0 before 6.5.3
  • From 6.4.0 before 6.4.6
  • From 6.3.0 before 6.3.10
  • From 6.2.0 before 6.2.13.1
All 8 release lines
  • Every version up to 6.5.1
  • From 5.0.0 before 5.0.18
  • From 6.0.0 before 6.0.14
  • From 6.1.0 before 6.1.13
  • From 6.2.0 before 6.2.13.1
  • From 6.3.0 before 6.3.10
  • From 6.4.0 before 6.4.6
  • From 6.5.0 before 6.5.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-5607
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-5607