Splunk.Web.Component.Parameter.Injection

Description

This indicates an attack attempt against Cross Site Scripting, Denial of Service and Information disclosure vulnerabilities in Splunk.
The vulnerability is due to the application's failure to sufficiently sanitize user-supplied data. Successful attacks may allow attackers to execute arbitrary HTML and script code or crash the vulnerable system.

Affected Products

Splunk Splunk 4.1.6
Splunk Splunk 4.1.3
Splunk Splunk 4.1.2
Splunk Splunk 4.1.1
Splunk Splunk 4.0.11
Splunk Splunk 4.0.10
Splunk Splunk 4.0.9
Splunk Splunk 4.0.8
Splunk Splunk 4.0.7
Splunk Splunk 4.0.6
Splunk Splunk 4.0.5
Splunk Splunk 4.0.4
Splunk Splunk 4.0.3
Splunk Splunk 4.0.2
Splunk Splunk 4.0.1
Splunk Splunk 4.0
Splunk Splunk 4.2.3
Splunk Splunk 4.2.2
Splunk Splunk 4.2
Splunk Splunk 4.1.5
Splunk Splunk 4.1.4
Splunk Splunk 4.1
Splunk Splunk 4

Impact

Information Disclosure: Remote attackers can gain sensitive information from
vulnerable systems.
Denial of Service: Remote attackers can crash vulnerable systems.

Recommended Actions

Apply the patch supplied by the vendor.
http://www.splunk.com/view/SP-CAAAGGH

References