Cross-site scripting (XSS) vulnerability in the Dashboard in Splunk Enterprise 6.2.x before 6.2.4 and Splunk Light 6.2.x before 6.2.4 allows

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• splunk splunk6.2.0
• splunk splunk6.2.1
• splunk splunk6.2.2
• splunk splunk6.2.3

Other highest-scoring records for the same primary product.

• CVE-2026-20253Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk EnterpriseKEV
  98Now
• CVE-2023-32707‘edit_user’ Capability Privilege Escalation
  59Plan
• CVE-2018-11409Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demon
  50Plan
• CVE-2026-20251Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway
  45Plan
• CVE-2023-32714Path Traversal in Splunk App for Lookup File Editing
  45Plan
• CVE-2022-32158Splunk Enterprise deployment servers allow client publishing of forwarder bundles
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1commentEl.innerHTML = comment.body;

1commentEl.textContent = comment.body;

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.