Skip to main content

Splunk Cloud Platform EUVD-2025-32715

| CVE-2025-20367 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2025-10-01 psirt@cisco.com
XSS Splunk Cloud Platform Splunk
5.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.7 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Patch available
Apr 16, 2026 - 05:29 EUVD
9.3.2408.119,9.3.6,9.2.8
EUVD ID Assigned
Mar 13, 2026 - 18:18 euvd
EUVD-2025-32715
Analysis Generated
Mar 13, 2026 - 18:18 vuln.today
CVE Published
Oct 01, 2025 - 17:15 nvd
MEDIUM 5.7

DescriptionCVE.org

In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload through the dataset.command parameter of the /app/search/table endpoint, which could result in execution of unauthorized JavaScript code in the browser of a user.

Analysis

In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload through the dataset.command parameter of the /app/search/table endpoint, which could result in execution of unauthorized JavaScript code in the browser of a user.

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

More from same product – last 7 days

CVE-2026-20254 MEDIUM
5.7 Jun 10

CSS injection in Splunk Enterprise and Splunk Cloud Platform classic dashboards enables credential and sensitive data ex
CVE-2026-20255 MEDIUM
5.7 Jun 10

Classic dashboard URL validation bypass in Splunk Enterprise and Splunk Cloud Platform enables low-privileged authentica
CVE-2026-20256 MEDIUM
5.7 Jun 10

Classic dashboard drill-down links in Splunk Enterprise and Splunk Cloud Platform can be weaponized by low-privileged au
CVE-2026-20257 MEDIUM
5.7 Jun 10

Classic dashboard style attribute injection in Splunk Enterprise and Splunk Cloud Platform enables a low-privileged auth
CVE-2026-20259 MEDIUM
5.5 Jun 10

Improper access control on the saved search ownership reassignment endpoint in Splunk Enterprise and Splunk Cloud Platfo

Share

EUVD-2025-32715 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy