This vulnerability affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. It arises from insufficient output encoding of user-controllable input in Splunk Web tours, enabling a user with the "power" role to inject JavaScript that executes in the browser of another user who opens a crafted tour link. The injected script runs with the privileges of the affected user, potentially exposing all data accessible to that user. The vulnerability requires that the victim user interact by opening the malicious link. The flaw is due to the tour selector value being treated as markup without proper neutralization.

Successful exploitation allows an attacker with the "power" role to execute arbitrary JavaScript in the context of another user's browser session, potentially exposing all data accessible to that user. There is no impact on system integrity or availability. The attack requires the victim to open a crafted tour link, so social engineering or phishing is necessary.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of the "power" Splunk role to trusted users only and educate users to avoid opening untrusted or suspicious tour links. Monitor vendor communications for updates on patches or official mitigations.