Loading vulnerability…
Cross-Site Scripting in Splunk Enterprise and Splunk Cloud Platform dataset.command
CVE-2025-20367 is a cross-site scripting vulnerability in Splunk Enterprise versions earlier than 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions earlier than 9.3.2411.109, 9.3.2408.119, and 9.2.2406.122. A low-privileged Splunk user without the admin or power role can place a malicious payload in the dataset.command parameter supplied to the /app/search/table endpoint. Processing the payload can cause unauthorized JavaScript execution in another user’s browser.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables unauthorized JavaScript execution in a user’s browser. The cross-site scripting flaws CVE-2025-20367 and CVE-2025-20368 may expose user sessions and sensitive data.
If you can’t patch tonight, do this now.
No CVE-2025-20367-specific compensating control is identified. As a temporary general Splunk Web mitigation, disable Splunk Web when it is not required and restrict assignment of high-privilege roles; these measures do not replace applying the fixed version.
Patch, then assume compromise.
Upgrade Splunk Enterprise to 9.4.4, 9.3.6, 9.2.8, or a later applicable release. For Splunk Cloud Platform, apply the applicable fixed build: 9.3.2411.109, 9.3.2408.119, 9.2.2406.122, or later. Splunk Cloud Platform patches are applied automatically according to the available information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.