Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF). This vulnerability could allow an attacker to perform REST API calls on behalf of an authenticated high-privileged user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-20371 |
Exploitation
To exploit this vulnerability, an attacker must be able to send crafted requests to the affected Splunk services. By leveraging the SSRF, the attacker can manipulate the server into making requests to internal resources or external services, potentially gaining access to sensitive information or executing unauthorized actions as a high-privileged user.
Affected Products
- Splunk Enterprise versions below 10.0.1
- Splunk Enterprise versions below 9.4.4
- Splunk Enterprise versions below 9.3.6
- Splunk Enterprise versions below 9.2.8
- Splunk Cloud Platform versions below 9.3.2411.109
- Splunk Cloud Platform versions below 9.3.2408.119
- Splunk Cloud Platform versions below 9.2.2406.122
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform. Additionally, implementing network security measures to restrict access to the affected services can help prevent unauthorized exploitation.