A stored cross‑site scripting flaw exists in classic dashboards of Splunk when an attacker can create a malicious HTML panel. The injected script is executed in the browser of any user who opens the affected dashboard, allowing the attacker to steal session cookies, redirect the user, or perform other client‑side malicious actions. The weakness is a classic input validation flaw (CWE-79) that can lead to unintended code execution in user browsers and compromise confidentiality and integrity of user sessions.

Splunk Enterprise version 10.2.4 or earlier, 10.0.7 or earlier, 9.4.12 or earlier, and 9.3.13 or earlier, and Splunk Cloud Platform version 10.3.2512.11 or earlier, 10.2.2510.15 or earlier, 10.1.2507.23 or earlier, and 9.3.2411.132 or earlier are affected.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to trick a victim into loading the malicious dashboard (phishing scenario); the low‑privileged user who creates the panel must not have admin or power roles, limiting the attacker’s ability to repeat the attack. The risk is therefore moderate overall, but the potential for session hijacking or credential theft requires timely remediation.