CNNVD-202510-041 Information
CNNVD ID
CNNVD-202510-041
Related CVE
- CNNVD Published: 2025-10-01
Description (Chinese)
Splunk Cloud Platform和Splunk Enterprise都是美国Splunk公司的产品。Splunk Cloud Platform是一个强大的数据收集、处理和分析服务。Splunk Enterprise是一套数据收集分析软件。 Splunk Enterprise和Splunk Cloud Platform存在跨站脚本漏洞，该漏洞源于低权限用户可通过错误消息和保存搜索作业检查详情构造恶意有效载荷，可能导致在用户浏览器中执行未经授权的JavaScript代码。以下版本受到影响：Splunk Enterprise 9.4.4之前版本、9.3.6之前版本和9.2.8之前版本以及Splunk Cloud Platform 9.3.2411.108之前版本、9.3.2408.118之前版本和9.2.2406.123之前版本。
Description (English)
Splunk Cloud Platform and Splunk Enterprise are products of the United States company Splunk. Splung Cloud Platform is a powerful data collection, processing and analysis service. Splung Enterprise is a data collection and analysis software. Splunk Enterprise and Splunk Cloud Platform have a cross-site script loophole, which stems from the fact that low-authority users can construct a malicious payload through error messages and the preservation of search details, which may result in the unauthorized JavaScript code being executed in the user browser. The following versions were affected: the previous version of Splunk Enterprise 9.4.4, the previous version of 9.3.6 and the pre-version of 9.2.8 and the pre-version of Splunk Cloud Platform 9.3.2411.108, the pre-version of 9.3.2408.118 and the pre-version of 9.2.2406.123.
Hazard Level
High
Vulnerability Type
跨站脚本
Affected Vendor
Splunk
Published
2025-10-01
Last Modified
2026-02-24
References
https://advisory.splunk.com/advisories/SVD-2025-1003 https://vigilance.fr/vulnerability/Splunk-Enterprise-Cross-Site-Scripting-via-Saved-Search-Job-Inspector-48365
Patch
https://advisory.splunk.com/advisories/SVD-2025-1005
Share on: