CVE-2013-6772: Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking

Security readout for executives and security teams

Older Splunk versions before 5.0.4 did not set X-Frame-Options, which can let an attacker frame the Splunk UI inside another page and trick a signed-in user into unintended clicks. Business risk depends on whether privileged users can access the affected Splunk web interface. Exposure is most likely where Splunk web interfaces running versions before 5.0.4 are reachable by users, especially administrators. Internet exposure would increase concern, but the bundle does not state deployment scope. Treat this as a targeted hardening issue, not an emergency based on the provided evidence. Prioritize if legacy Splunk is still in use, exposed broadly, or accessed by privileged operators. Mitigation focus: Identify Splunk instances and confirm their exact versions.; Prioritize upgrades for any Splunk instance older than 5.0.4.; Review the Splunk advisory for vendor-confirmed remediation guidance..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.