CVE-2025-20297 — Reflected Cross-Site Scripting (XSS) on Splunk Enterprise through dashboard PDF generation component

Description (CNA)

In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint that could result in execution of unauthorized JavaScript code in the browser of a user.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 9.4 before 9.4.2; affected 9.3 before 9.3.4; affected 9.2 before 9.2.6; affected 9.1 before 9.1.9
Splunk / Splunk Cloud Platform	affected 9.3.2411 before 9.3.2411.102; affected 9.3.2408 before 9.3.2408.111; affected 9.2.2406 before 9.2.2406.118

CWE

CWE-79

References

https://advisory.splunk.com/advisories/SVD-2025-0601

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.