Splunk Stored Cross-Site Scripting Vulnerability in Saved Search and Job Inspector

A stored cross-site scripting vulnerability has been identified in Splunk Enterprise versions prior to 9.4.4, 9.3.6, and 9.2.8, as well as in Splunk Cloud Platform versions prior to 9.3.2411.108, 9.3.2408.118, and 9.2.2406.123. This vulnerability allows a low-privileged user, who does not have admin or power roles, to inject a malicious payload into the error messages and job inspection details of a saved search. The injected payload could then execute unauthorized JavaScript code in the browser of a user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user.

Remediation

Users of Splunk Enterprise should upgrade to versions 9.4.4, 9.3.6, or 9.2.8. For Splunk Cloud Platform users, Splunk is actively monitoring and patching instances. Additionally, turning off Splunk Web can mitigate the vulnerability.