A low‑privileged Splunk user can create an interface view that contains a malicious JavaScript payload when accessing the /manager/launcher/data/ui/views/_new endpoint. The payload is stored and later rendered in other users’ browsers, allowing the attacker to execute unauthorized JavaScript in the victim’s browser session. The weakness is a classic stored XSS, identified as CWE‑79, and can compromise confidentiality, integrity or availability of the affected system if the executed script performs malicious actions such as credential theft or further propagation.

Splunk Cloud Platform and Splunk Enterprise are affected. Versions below 10.2.0, 10.0.3, 9.4.9, and 9.3.9 for Enterprise; and below 10.2.2510.4, 10.1.2507.15, 10.0.2503.11, and 9.3.2411.123 for Cloud Platform are vulnerable.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a phishing‑style vector where the victim’s browser initiates the request; an authenticated, non‑admin user must create the view, so the attack cannot be performed freely by an unauthenticated attacker.