Multiple Vulnerabilities in Splunk Enterprise and Cloud Expose Data to Exfiltration

Splunk has disclosed several vulnerabilities affecting its Enterprise and Cloud platforms, specifically versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13. These vulnerabilities allow low-privileged users to exfiltrate sensitive data through crafted classic dashboards and other methods. Attack vectors include CSS injection, protocol-relative URLs, and flawed URL validation, enabling unauthorized access to external domains. The vulnerabilities have been rated with severity scores ranging from 5.7 (Medium) to 9.8 (Critical). Users are advised to upgrade to the latest versions and restrict dashboard permissions to mitigate risks. Splunk is actively monitoring and patching affected instances. The vulnerabilities impact organizations using Splunk for data analysis and monitoring.

Key Points: • Splunk vulnerabilities allow low-privileged users to exfiltrate data via crafted dashboards. • Affected versions include Splunk Enterprise below 10.2.4 and Splunk Cloud below 10.4.2604.3. • Splunk rates the most severe vulnerability at 9.8, indicating critical risk.