| Package | Affected versions | Patched versions |
|---|---|---|
| splunk | ≥ 9.0.0, < 9.0.4 | 9.0.4 |
| splunk cloud platform | < 9.0.2209.3 | 9.0.2209.3 |
In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free