Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2023-32711

Persistent Cross-Site Scripting (XSS) through a URL Validation Bypass within a Dashboard View

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Splunk

Description

In Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, a Splunk dashboard view lets a low-privileged user exploit a vulnerability in the Bootstrap web framework (CVE-2019-8331) and build a stored cross-site scripting (XSS) payload.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Splunk Splunk Enterprise

  • 8.1 to < 8.1.14affected
  • 8.2 to < 8.2.11affected
  • 9.0 to < 9.0.5affected

References