Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a user with high-privilege capability can send multiple LDAP bind requests to an internal endpoint. This can result in high server CPU usage, potentially leading to a denial of service until the instance is restarted.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.9 | CVE-2025-20370 |
Exploitation
To exploit this vulnerability, an attacker with a role that includes the high-privilege capability ‘change_authentication’ can send numerous LDAP bind requests to a specific internal endpoint. This action can overwhelm the server’s CPU, causing it to become unresponsive and leading to a denial of service condition.
Affected Products
- Splunk Enterprise versions below 10.0.1
- Splunk Enterprise versions below 9.4.4
- Splunk Enterprise versions below 9.3.6
- Splunk Enterprise versions below 9.2.8
- Splunk Cloud Platform versions below 9.3.2411.108
- Splunk Cloud Platform versions below 9.3.2408.118
- Splunk Cloud Platform versions below 9.2.2406.123
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform. Additionally, limiting the roles that have the ‘change_authentication’ capability can help reduce the risk of exploitation.