In Splunk Enterprise and Splunk Cloud Platform, versions before 10.2.4, 10.0.7, 9.4.12, and 9.3.13 (Enterprise) and before 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132 (Cloud) allow a low‑privileged user to craft a classic dashboard that contains unvalidated CSS style attributes. When a higher‑privileged user opens the dashboard, the browser can send requests to external domains not included in the Trusted Domains List, enabling the attacker to capture sensitive information from the victim’s browser. The flaw is a classic input validation issue (CWE‑20).

Splunk Enterprise versions earlier than 10.2.4, 10.0.7, 9.4.12, or 9.3.13, and Splunk Cloud Platform versions earlier than 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, or 9.3.2411.132 are affected.

The CVSS score of 5.7 indicates moderate severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a low‑privileged account and a social‑engineering step to make a higher‑privileged user view the malicious dashboard; it cannot be leveraged automatically by the low‑privileged user alone. Therefore, while the potential for data leakage exists, effective exploitation hinges on user interaction and therefore the overall risk is constrained.