Technical impact
Deployment Server endpoints in Splunk Web do not validate CSRF tokens on GET requests and do not neutralize caller‑supplied input before inserting it into an SPL query, a weakness identified as CWE‑352 <Cross‑Site Request Forgery>. As a result, an attacker can trick a user who has the list_deployment_server capability to execute arbitrary SPL searches as the splunk‑system‑user, allowing the attacker to read stored credentials and indexed data. This flaw allows an attacker to obtain any information that the target user can access, effectively giving the attacker the same privileges as the target.
Affected Systems
Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2510.18, and 10.1.2507.24 are affected. Only users whose roles contain the list_deployment_server capability can be coerced into executing the vulnerable request.
Risk and Exploitability
The CVSS score of 8.3 classifies this as a high‑severity vulnerability. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a CSRF request delivered through social engineering or phishing that forces the victim to send a crafted GET request to the vulnerable endpoint. Successful exploitation grants the attacker system‑level read access to credentials and indexed content.
