Pavan Saxena

A stored Cross-Site Scripting (XSS) issue exists in the contact detail view. HTML-type custom contact fields are rendered without output sanitization, allowing a user or integration to store a script payload via contact editing, the contact API, or form submissions mapped to the field. When an administrator or another user views the affected contact's detail page, the script executes in their browser session. This can lead to unauthorized administrative actions, including the creation of new administrator accounts, modification of system configurations, or unauthorized access to campaign and contact data.

An unauthenticated user positioned in the network path can read or modify data sent from the connector when Kerberos authentication is used with the Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. This occurs because the Kerberos authentication path fails to apply the configured certificate validation options during the construction of the HTTP client.

Insufficient escaping of user-supplied text occurs before it is written into a generated PHP pattern file. This allows a multisite subsite administrator, who possesses the capability to perform this action but is restricted from editing PHP files, to inject and execute arbitrary PHP code on the server.