This vulnerability in Splunk Enterprise and Splunk Cloud Platform arises from incomplete validation of URLs in the external content dialog. Low-privileged users lacking admin or power roles can exploit this by creating malicious classic dashboards that cause data exfiltration to external servers. The affected versions include Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132. The vulnerability does not affect confidentiality, integrity, or availability beyond the described data exfiltration vector. There is no known exploit in the wild and no vendor advisory or patch information provided in the input data.

An attacker with low privileges can exfiltrate sensitive data by exploiting incomplete URL validation in dashboards, potentially leading to unauthorized data disclosure. The vulnerability does not allow privilege escalation, integrity modification, or denial of service. The impact is limited to confidentiality with a medium severity rating (CVSS 5.7).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, restrict dashboard creation permissions to trusted users and monitor for unusual dashboard activity involving external content dialogs.