Splunk Enterprise EUVD-2025-32715

Exploitation requires an authenticated Splunk account with any role BELOW 'admin' or 'power' (PR:L) and the ability to reach Splunk Web's /app/search/table endpoint with a crafted dataset.command parameter value. The payload only fires when a victim user loads/views the malicious table view (UI:R) - meaning a second user, ideally higher-privileged, must be lured into rendering it; the attacker cannot trigger impact unaided. Limiting factors: valid low-privileged credentials are mandatory (no anonymous access), victim interaction is mandatory, and impact is confined to in-browser JavaScript execution within the Splunk session rather than direct server compromise.

This is a stored/DOM cross-site scripting flaw (CWE-79) in the Splunk Web /app/search/table endpoint, and the combined signals point to a genuine-but-moderate priority rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) tells a coherent story that matches the description: network-reachable, low attack complexity, but it requires a pre-authenticated low-privileged account (PR:L) AND victim interaction (UI:R), with only partial confidentiality/integrity impact and no availability impact. The scope change (S:C) is justified because injected JavaScript executes in another user's browser session, potentially a higher-privileged admin. EPSS is very low at 0.03% (8th percentile) and the CVE is NOT on CISA KEV, with no public exploit referenced - so there is no evidence of active or imminent mass exploitation. The signals are internally consistent (no contradiction between CVSS network vector and the description, which also implies an authenticated web user), so no conflict needs flagging. Net assessment: a credible privilege-escalation-via-XSS risk for any multi-tenant or shared Splunk deployment where low-privileged accounts exist, but not a drop-everything issue; patch on a normal prioritized cycle.

A low-privileged but authenticated Splunk user (lacking the 'admin' or 'power' roles) crafts a malicious payload in the dataset.command parameter of the /app/search/table endpoint; when a higher-privileged user is induced to load the resulting view, the attacker's JavaScript executes in that victim's browser within the Splunk session context. No public exploit code was identified at time of analysis, so this remains a plausible but not demonstrated attack requiring both valid credentials and victim interaction.