Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user could craft a malicious payload through error messages and job inspection details of a saved search. This could result in execution of unauthorized JavaScript code in the browser of a user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.7 | CVE-2025-20368 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can create a malicious payload by manipulating error messages and job inspection details in a saved search. When a user interacts with this crafted payload, it can lead to the execution of unauthorized JavaScript code in their browser, potentially compromising their session or data.
Affected Products
- Splunk Enterprise versions below 9.4.4
- Splunk Enterprise versions below 9.3.6
- Splunk Enterprise versions below 9.2.8
- Splunk Cloud Platform versions below 9.3.2411.108
- Splunk Cloud Platform versions below 9.3.2408.118
- Splunk Cloud Platform versions below 9.2.2406.123
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform that are not affected by this issue. Additionally, organizations should implement strict access controls and monitor user interactions to prevent unauthorized actions.