Splunk Enterprise 9.3.0 < 9.3.13, 9.4.0 < 9.4.12, 10.0.0 < 10.0.7, 10.2.0 < 10.2.4 (SVD-2026-0607)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320364);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/12");

  script_cve_id("CVE-2026-20257");
  script_xref(name:"IAVA", value:"2026-A-0593");

  script_name(english:"Splunk Enterprise 9.3.0 < 9.3.13, 9.4.0 < 9.4.12, 10.0.0 < 10.0.7, 10.2.0 < 10.2.4 (SVD-2026-0607)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by a vulnerability");
  script_set_attribute(attribute:"description", value:
"The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a
vulnerability as referenced in the SVD-2026-0607 advisory.

  - In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions
    below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold
    the admin or power Splunk roles could craft a classic dashboard that exfiltrates sensitive data from
    the browser of a higher-privileged user who views it. The exfiltration is possible because classic
    dashboard panels do not fully validate style attribute values, which can allow for requests to reach
    external domains outside the configured Trusted Domains List. The vulnerability requires the attacker to
    phish the victim by tricking them into initiating a request within their browser. The low-privileged user
    should not be able to exploit the vulnerability at will. See Classic Dashboards Trusted Domains List and
    About role-based user access in the Splunk documentation. (CVE-2026-20257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://advisory.splunk.com/advisories/SVD-2026-0607.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Splunk Enterprise to versions 10.4.0, 10.2.4, 10.0.7, 9.4.12, and 9.3.13, or higher.Splunk is actively
monitoring and patching Splunk Cloud Platform instances.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20257");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/10");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:splunk:splunk");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("splunkd_detect.nasl", "splunk_web_detect.nasl", "macos_splunk_installed.nbin", "splunk_win_installed.nbin", "splunk_nix_installed.nbin");
  script_require_keys("installed_sw/Splunk", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_splunk.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::splunk::get_app_info();

var constraints = [
  { 'min_version' : '9.3.0', 'fixed_version' : '9.3.13', 'license' : 'Enterprise' },
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.12', 'license' : 'Enterprise' },
  { 'min_version' : '10.0.0', 'fixed_version' : '10.0.7', 'license' : 'Enterprise' },
  { 'min_version' : '10.2.0', 'fixed_version' : '10.2.4', 'license' : 'Enterprise' }
];
vcf::splunk::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);