Splunk Enterprise XSS Vulnerability Let Attackers Execute Unauthorized JavaScript Code
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A significant security vulnerability in the Splunk Enterprise platform could allow low-privileged attackers to execute unauthorized JavaScript code through a reflected Cross-Site Scripting (XSS) flaw.\u00a0<\/p>\n
The vulnerability, tracked as CVE-2025-20297, affects multiple versions of Splunk Enterprise<\/a> and Splunk Cloud Platform, prompting the company to issue immediate security updates.<\/p>\n The reflected XSS vulnerability resides within Splunk Enterprise\u2019s dashboard PDF generation component, specifically targeting the pdfgen\/render REST endpoint.\u00a0<\/p>\n This security flaw enables attackers with minimal system privileges to craft malicious payloads that can execute arbitrary JavaScript code in victim browsers.\u00a0<\/p>\n The vulnerability is classified under CWE-79 (Cross-Site Scripting<\/a>) and has been assigned a CVSSv3.1 score of 4.3, indicating a medium-severity risk level.<\/p>\n The attack vector is particularly concerning because it requires only low-level user privileges, excluding those with \u201cadmin\u201d or \u201cpower\u201d Splunk roles.\u00a0<\/p>\n This means that standard users with limited access can potentially exploit the vulnerability to compromise other users\u2019 sessions.\u00a0<\/p>\n The CVSSv3.1 vector string CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:N\/A:N indicates that the attack can be executed remotely with low complexity, requiring low privileges but no user interaction.<\/p>\nSplunk Enterprise XSS Vulnerability<\/strong><\/h2>\n