Description
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send server-side requests to arbitrary internal destinations through the Dashboard Studio PDF export feature. The vulnerability exists because the trusted-domain validation uses a prefix match that can be bypassed with attacker-controlled subdomains (for example, docs.splunk.com.evil.com), and because the PDF export service follows HTTP redirects automatically without re-validating each redirect target against the allowlist.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Splunk Splunk Enterprise
10.2 to < 10.2.4affected10.0 to < 10.0.7affected9.4 to < 9.4.12affected9.3 to < 9.3.13affected
Splunk Splunk Cloud Platform
10.4.2604 to < 10.4.2604.3affected10.3.2512 to < 10.3.2512.12affected10.2.2510 to < 10.2.2510.14affected10.1.2507 to < 10.1.2507.22affected9.3.2411 to < 9.3.2411.132affected