CVE-2025-20226

Published Mar 26, 2025

Last updated 9 months ago

CVSS medium 5.7

Overview

Description: In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on the "/services/streams/search" endpoint through its "q" parameter. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.
Source: psirt@cisco.com
NVD status: Analyzed
Products: splunk, splunk_cloud_platform

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.7
Impact score: 3.6
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

psirt@cisco.com: CWE-200

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "49EE75F0-2AD6-4712-9E2A-C000A44E5605",
            "versionEndExcluding": "9.1.8",
            "versionStartIncluding": "9.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "5B7E20B1-E38E-4F5E-9F89-41FD4C231742",
            "versionEndExcluding": "9.2.5",
            "versionStartIncluding": "9.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "E66E66BA-AFC2-4E0A-B233-9E2C7D985AF0",
            "versionEndExcluding": "9.3.3",
            "versionStartIncluding": "9.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:9.4.0:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "AD39F156-52DB-4F43-8528-37500E3AEB89",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2E95F34F-276A-4B6C-B317-DB58839B34CE",
            "versionEndExcluding": "9.1.2308.214",
            "versionStartIncluding": "9.1.2308",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4EBEB019-22E2-4948-AA77-85E0AC8219F8",
            "versionEndExcluding": "9.2.2406.111",
            "versionStartIncluding": "9.2.2406.100",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E0D477D5-C135-4D18-BC7D-94D4A5F34E1D",
            "versionEndExcluding": "9.3.2408.107",
            "versionStartIncluding": "9.3.2408.100",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References