In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload through the `dataset.command` parameter of the `/app/search/table` endpoint, which could result in execution of unauthorized JavaScript code in the browser of a user.
2025-10-01T17:15:39.703
2025-10-08T20:22:49.717
Analyzed
CVSSv3.1: 5.7 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | splunk | splunk | < 9.2.8 | Yes |
| Application | splunk | splunk | < 9.3.6 | Yes |
| Application | splunk | splunk | < 9.4.4 | Yes |
| Application | splunk | splunk_cloud_platform | < 9.2.2406.122 | Yes |
| Application | splunk | splunk_cloud_platform | < 9.3.2408.119 | Yes |
| Application | splunk | splunk_cloud_platform | < 9.3.2411.109 | Yes |