CVE-2011-4778: Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 4.2.x before 4.2.5 allows remote attackers...

Security readout for executives and security teams

This is an old Splunk Web XSS issue affecting Splunk 4.2.x before 4.2.5. A remote attacker could inject script or HTML through unspecified vectors. The sources do not provide CVSS, detailed vectors, or evidence of active exploitation. Exposure is most likely limited to legacy Splunk Web 4.2.x deployments that have not been upgraded to 4.2.5 or later. Current exposure cannot be inferred from the sources. Treat this as a legacy exposure cleanup item unless an affected Splunk Web instance is still reachable. Prioritize promptly if Splunk 4.2.x remains in use, because Splunk often handles sensitive operational and security data. Mitigation focus: Identify any Splunk 4.2.x deployments still running Splunk Web.; Upgrade affected Splunk 4.2.x systems to 4.2.5 or a supported release.; Review Splunk advisory SP-CAAAGMM for vendor-specific guidance..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.