CVE-2023-46213CWE-79

Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page

Medium · published November 16, 2023

CVSS v3.1
4.8
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized code in a user’s web browser.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-11-16T20:15Z
EPSS history
Timeline
  • 16 NOV 20:15Z
    Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page
    cvelistv5