Tony Tong

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.13 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 9.3.2411.132 **Description** A low-privileged user without "admin" or "power" roles can create a malicious classic dashboard to exfiltrate sensitive data to an external server. This occurs due to incomplete URL validation within the external content dialog, which allows requests to be sent to untrusted domains when a user interacts with the crafted dashboard. **Recommendations** Update Splunk Enterprise to version 10.2.4 or later. Update Splunk Enterprise to version 10.0.7 or later. Update Splunk Enterprise to version 9.4.12 or later. Update Splunk Enterprise to version 9.3.13 or later. Update Splunk Cloud Platform to version 10.3.2512.13 or later. Update Splunk Cloud Platform to version 10.2.2510.15 or later. Update Splunk Cloud Platform to version 10.1.2507.23 or later. Update Splunk Cloud Platform to version 9.3.2411.132 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.13 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 9.3.2411.132 **Description** A low-privileged user without 'admin' or 'power' roles can cause data exfiltration via classic dashboards. This is possible by redirecting a victim to an external site using a protocol-relative URL in a drill-down link. The issue occurs because the URL classifier in classic dashboards only identifies `http://` and `https://` schemes as external, allowing protocol-relative URLs (e.g., `//attacker.com`) to bypass the check and avoid the external-navigation warning dialog in Splunk Web. **Recommendations** Update Splunk Enterprise to version 10.2.4 or later. Update Splunk Enterprise to version 10.0.7 or later. Update Splunk Enterprise to version 9.4.12 or later. Update Splunk Enterprise to version 9.3.13 or later. Update Splunk Cloud Platform to version 10.3.2512.13 or later. Update Splunk Cloud Platform to version 10.2.2510.15 or later. Update Splunk Cloud Platform to version 10.1.2507.23 or later. Update Splunk Cloud Platform to version 9.3.2411.132 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.13 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 9.3.2411.132 **Description** A low-privileged user without admin or power roles can create a classic dashboard designed to exfiltrate sensitive data from the browser of a higher-privileged user. This occurs because classic dashboard panels fail to fully validate style attribute values, enabling requests to be sent to external domains that are not included in the Trusted Domains List. Exploitation requires the attacker to phish the victim into initiating a request within their browser. **Recommendations** Update Splunk Enterprise to version 10.2.4 or later. Update Splunk Enterprise to version 10.0.7 or later. Update Splunk Enterprise to version 9.4.12 or later. Update Splunk Enterprise to version 9.3.13 or later. Update Splunk Cloud Platform to version 10.3.2512.13 or later. Update Splunk Cloud Platform to version 10.2.2510.15 or later. Update Splunk Cloud Platform to version 10.1.2507.23 or later. Update Splunk Cloud Platform to version 9.3.2411.132 or later.

**Name of the Vulnerable Software and Affected Versions** Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Enterprise versions prior to 9.4.12 Splunk Enterprise versions prior to 9.3.13 Splunk Cloud Platform versions prior to 10.3.2512.11 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 9.3.2411.132 **Description** A low-privileged user without admin or power roles can store a malicious script within a classic dashboard HTML panel. This allows unauthorized JavaScript code to execute in the browser of another user. Exploitation requires the attacker to phish the victim, tricking them into initiating a request within their browser. **Recommendations** Update Splunk Enterprise to version 10.2.4 or later. Update Splunk Enterprise to version 10.0.7 or later. Update Splunk Enterprise to version 9.4.12 or later. Update Splunk Enterprise to version 9.3.13 or later. Update Splunk Cloud Platform to version 10.3.2512.11 or later. Update Splunk Cloud Platform to version 10.2.2510.15 or later. Update Splunk Cloud Platform to version 10.1.2507.23 or later. Update Splunk Cloud Platform to version 9.3.2411.132 or later.