This vulnerability in Splunk Enterprise affects versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the schedule_search role can inject malicious scripts into alert trigger condition fields. The vulnerability is due to improper neutralization of user-controllable input before it is rendered in web pages served to other users. Exploitation requires another user to open a crafted link, causing the script to run in their browser and potentially access all data available to that user. The root cause is that Splunk Web uses alert threshold values in generated alert trigger condition markup without escaping special characters.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of another user's browser session, leading to potential unauthorized access to data available to that user. The vulnerability does not impact integrity or availability but compromises confidentiality of user data accessible through the affected Splunk instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the schedule_search capability to trusted users only and educate users to avoid opening untrusted or suspicious alert links. Monitor official Splunk advisories for updates on patches or official fixes.