Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS Vulnerability – CVE-2019-5727

NVD Published Date: 02/20/2019

Preface: SIEM can enforce your cyber security protection meanwhile it is the potential target by hacker.

Synopsis: So far Splunk did a remarkable analytic function. Furthermore SIEM product itselfs have their baseline protection feature. From technical point of view, it is not recommend apply WAF function to monitor their activities. Perhaps WAF will be provide large volume of false positive alarm thus interrupt SIEM functions. Therefore how to conduct management control in SIEM will be the major focus by cyber security expert.

Vulnerability found on Splunk: A Web Persistent Cross-Site Scripting Vulnerability occurs.

Impact: A successful exploit could allow the attacker to execute arbitrary script code in the context of the web interface.

Splunk has released a security advisory at the following link: https://www.splunk.com/view/SP-CAAAQAF