CVE-2025-20371
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-01 17:15:40.450000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-20371",
"sourceIdentifier": "[email protected]",
"published": "2025-10-01T17:15:40.450",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user."
},
{
"lang": "es",
"value": "En las versiones de Splunk Enterprise anteriores a 10.0.1, 9.4.4, 9.3.6 y 9.2.8, y en las versiones de Splunk Cloud Platform anteriores a 9.3.2411.109, 9.3.2408.119 y 9.2.2406.122, un atacante no autenticado podría desencadenar una falsificación de petición del lado del servidor (SSRF) ciega, lo que podría permitir a un atacante realizar llamadas a la API REST en nombre de un usuario autenticado con altos privilegios."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"versions": [
{
"version": "10.0",
"lessThan": "10.0.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.4",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3",
"lessThan": "9.3.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.2",
"lessThan": "9.2.8",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Cloud Platform",
"versions": [
{
"version": "9.3.2411",
"lessThan": "9.3.2411.109",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3.2408",
"lessThan": "9.3.2408.119",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.2.2406",
"lessThan": "9.2.2406.122",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-02T03:55:48.000082Z",
"id": "CVE-2025-20371",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.2.0",
"versionEndExcluding": "9.2.8",
"matchCriteriaId": "724443E6-2DC9-4AB3-8E8F-D9BFBCC162E6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.3.0",
"versionEndExcluding": "9.3.6",
"matchCriteriaId": "046659D8-1F48-4229-AC57-2A3B77D44442"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.4",
"matchCriteriaId": "88D2F283-10F9-4204-876A-9BEE75130E2C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:10.0.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "259A3F4B-E4D2-48BC-9AE9-C37DE94987D5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.2.2406",
"versionEndExcluding": "9.2.2406.122",
"matchCriteriaId": "DAA1E6F9-415D-4062-BC4E-4EDFA6F6A7CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.3.2408",
"versionEndExcluding": "9.3.2408.119",
"matchCriteriaId": "9BEB41CF-1F71-45BB-A434-984C16A2E174"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.3.2411",
"versionEndExcluding": "9.3.2411.109",
"matchCriteriaId": "A5075451-6D11-4EA8-9BB5-9BB27ECF8A40"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2025-1006",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}