What’s Vulnerable › Vulnerabilities

CVE-2017-5607

• Severity: low (CVSS 3.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-04-10 · updated 2026-06-17
• Weakness: CWE-200

Description

Splunk Enterprise 5.0.x before 5.0.18, 6.0.x before 6.0.14, 6.1.x before 6.1.13, 6.2.x before 6.2.13.1, 6.3.x before 6.3.10, 6.4.x before 6.4.6, and 6.5.x before 6.5.3 and Splunk Light before 6.5.2 assigns the $C JS property to the global Window namespace, which might allow remote attackers to obtain sensitive logged-in username and version-related information via a crafted webpage.

Affected products

• Splunk Enterprise: through 6.5.1; from 5.0.0 before 5.0.18; from 6.0.0 before 6.0.14; from 6.1.0 before 6.1.13; from 6.2.0 before 6.2.13.1; from 6.3.0 before 6.3.10 — fixed in 5.0.18, 6.0.14, 6.1.13, 6.2.13.1, 6.3.10, 6.4.6

How to fix

Upgrade to a fixed version: Splunk Enterprise 5.0.18, 6.0.14, 6.1.13, 6.2.13.1. Check the vendor advisory for mitigations.

References

• http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt
• http://seclists.org/fulldisclosure/2017/Mar/89
• http://www.securityfocus.com/archive/1/540346/100/0/threaded
• http://www.securityfocus.com/bid/97265
• http://www.securityfocus.com/bid/97286
• http://www.securitytracker.com/id/1038170
• https://www.exploit-db.com/exploits/41779/
• https://www.splunk.com/view/SP-CAAAPZ3#InformationLeakageviaJavaScriptCVE20175607
• http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt
• http://seclists.org/fulldisclosure/2017/Mar/89
• http://www.securityfocus.com/archive/1/540346/100/0/threaded
• http://www.securityfocus.com/bid/97265

Get alerted when CVE-2017-5607 or the next vulnerability affects your stack