Apps and add-ons
CVE-2023-32715: Self Cross-Site Scripting (XSS) on Splunk App for Lookup File Editing
In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk App for Lookup File Editing 4.0 | 4.0.1 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In the Splunk App for Lookup File Editing versions below 4.0.1, a user can insert potentially malicious JavaScript code into the app, which causes that code to run on the user’s machine. The app itself does not contain the potentially malicious JavaScript code. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser, and requires additional user interaction to trigger. The attacker cannot exploit the vulnerability at will.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.