CVE-2025-20371

Published Oct 1, 2025

Last updated 7 months ago

CVSS high 7.5
Splunk

Overview

Description
In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.
Source
psirt@cisco.com
NVD status
Analyzed
Products
splunk, splunk_cloud_platform

Risk scores

CVSS 3.1

Type
Primary
Base score
8.8
Impact score
5.9
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

psirt@cisco.com
CWE-918

Social media

Hype score
Not currently trending

  1. Splunk discloses six critical vulnerabilities including XSS, SSRF (CVE-2025-20371), and DoS risks impacting Enterprise and Cloud Platform versions. Patching and mitigations are advised to prevent remote JS injection. #SplunkSecurity #RemoteCode #XSS https://t.co/19cQBfXdWG

    @TweetThreatNews

    3 Oct 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. ⚠️Vulnerabilidad en productos Splunk ❗CVE-2025-20371 ➡️Más info: https://t.co/cHV8zh02b2 https://t.co/pX2FdJ32ek

    @CERTpy

    3 Oct 2025

    96 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-20371 and other: Multiple vulnerabilities in Splunk, 4.6 - 7.5 rating❗️ In a recent advisory, Splunk reported six vulnerabilities, including DoS, XXE, XSS, and Blind SSRF. Search at https://t.co/hv7QKSqxTR: 👉 Link: https://t.co/y8khGa5mQ5 https://t.co/FiUQVFBlHX

    @Netlas_io

    2 Oct 2025

    519 Impressions

    1 Retweet

    6 Likes

    3 Bookmarks

    0 Replies

    0 Quotes

  4. CVE-2025-20371 Unauthenticated Blind Server-Side Request Forgery in Splunk Enterprise and Cloud Platform https://t.co/mValzW6wcD

    @VulmonFeeds

    2 Oct 2025

    44 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Splunk Enterprise CVE-2025-20371: Unauthenticated Blind SSRF A new SSRF vuln in Splunk Enterprise lets attackers relay requests unauthenticated. Admins should patch ASAP. For more details, read ZeroPath's blog on this vuln. #AppSec #InfoSec https://t.co/MCkJ7hk4MH

    @ZeroPathLabs

    1 Oct 2025

    23 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.5, 10.2.2510.9, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles could potentially perform a Remote Code Execution (RCE) by uploading a malicious file to the `$SPLUNK_HOME/var/run/splunk/apptemp` directory due to improper handling and insufficient isolation of temporary files within the `apptemp` directory.•CVE-2026-20204
  2. In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles, has write permission on the app, and does not hold the high-privilege capability `accelerate_datamodel`, could turn on or off Data Model Acceleration due to improper access control.•CVE-2026-20203
  3. In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.20, 10.0.2503.13, and 9.3.2411.127, a user who holds a role that contains the high-privilege capability `edit_user`could create a specially crafted username that includes a null byte or a non-UTF-8 percent-encoded byte due to improper input validation.<br><br>This could lead to inconsistent conversion of usernames into a proper format for storage and account management inconsistencies, such as being unable to edit or delete affected users.•CVE-2026-20202
  4. In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. <br><br>Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) and [Connecting to MCP Server and Admin settings](https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/connecting-to-mcp-server-and-admin-settings) in the Splunk documentation for more information.•CVE-2026-20205
  5. In Splunk Enterprise versions below 10.2.1 and 10.0.4, and Splunk Cloud Platform versions below 10.2.2510.5, 10.1.2507.16, and 10.0.2503.12, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve the Observability Cloud API access token through the Discover Splunk Observability Cloud app due to improper access control. This vulnerability does not affect Splunk Enterprise versions below 9.4.9 and 9.3.10 because the Discover Splunk Observability Cloud app does not come with Splunk Enterprise.•CVE-2026-20166

References

Sources include official advisories and independent security research.