CVE-2010-2429: Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allow...

Security readout for executives and security teams

This issue affects old Splunk 4.0 through 4.1.2 when accessed with Internet Explorer. A malicious HTTP Referer value could be reflected in a 404 error page, allowing script or HTML injection. It matters most where legacy Splunk is still used by privileged operators. Exposure is likely limited to legacy Splunk 4.0-4.1.2 deployments and users accessing them with Internet Explorer. Internet-facing or broadly reachable Splunk consoles would carry higher concern, especially for administrator sessions. Treat this as a legacy exposure cleanup item unless an affected Splunk console is still reachable by privileged users. Prioritize verification because Splunk often contains sensitive operational and security data. Mitigation focus: Identify any Splunk 4.0 through 4.1.2 deployments.; Check Splunk advisory SP-CAAAFHY for vendor fix or workaround guidance.; Retire, isolate, or upgrade unsupported legacy Splunk instances..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.