In Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a stored cross-site scripting vulnerability exists in Dashboard Studio. A user with the 'power' role can embed a malicious URL in a workflow action. When another authenticated user selects this action and continues, the embedded JavaScript executes in their browser context. This occurs because Dashboard Studio does not properly neutralize or validate user-controllable input before rendering it in web pages served to other users. The vulnerability requires user interaction via phishing to trigger the malicious script execution. The 'power' role user cannot exploit this vulnerability directly without tricking others.

Successful exploitation allows attacker-controlled JavaScript to run in the browsers of authenticated users, potentially exposing sensitive data or enabling unauthorized actions within Splunk Web. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). However, exploitation requires social engineering and a user with the 'power' role to store the malicious payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of the 'power' role to trusted users only and educate users about phishing risks. Monitor Splunk documentation and advisories for updates on patches addressing this vulnerability.