{"id":"CVE-2017-12572","aliases":["EUVD-2017-4144","GHSA-p949-mvf5-2jgv"],"status":"published","title":"Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x...","description":"Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.","severity":{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00503,"percentile":0.43289,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2017-08-05T21:00:00Z","modified":"2026-06-17T01:03:31Z","products":[{"vendor":"splunk","product":"splunk"}],"references":[{"url":"https://www.splunk.com/view/SP-CAAAPYC","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12572"},{"url":"https://github.com/advisories/GHSA-p949-mvf5-2jgv"}],"sources":{"cve":[{"id":"CVE-2017-12572","description":"Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.","status":"published","published":"2017-08-05T21:00:00Z","modified":"2024-09-17T00:41:23.645Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-4144","description":"Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.","status":"published","published":"2017-08-05T21:00:00Z","modified":"2024-09-17T00:41:23Z","updated_at":"2026-11-03T00:28:56.965297Z"}],"ghsa":[{"id":"GHSA-p949-mvf5-2jgv","title":"Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x...","description":"Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.","status":"published","published":"2022-05-17T02:13:48Z","modified":"2023-01-27T05:03:45Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:42:18.839693Z"}],"nvd":[{"id":"CVE-2017-12572","description":"Persistent Cross Site Scripting (XSS) exists in Splunk Enterprise 6.5.x before 6.5.2, 6.4.x before 6.4.6, and 6.3.x before 6.3.9 and Splunk Light before 6.5.2, with exploitation requiring administrative access, aka SPL-134104.","status":"published","published":"2017-08-05T21:29:00.177Z","modified":"2026-06-17T01:03:31.5Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:57.282351Z"}]}}