Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a low-privileged user could create a views dashboard with a custom background using a specific protocol that could lead to an unvalidated redirect. This behavior circumvents the external URL warning mechanism, allowing redirection to a malicious site. The vulnerability requires the attacker to phish the victim into initiating a request within their browser.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 3.5 | CVE-2025-20382 |
Exploitation
To exploit this vulnerability, an attacker must first trick a victim into clicking a specially crafted link that initiates a request in their browser. The attacker can use social engineering techniques to create a convincing scenario that encourages the victim to interact with the malicious link. Once the victim clicks the link, the attacker can redirect them to an external site without their consent, potentially leading to further exploitation.
Affected Products
- Splunk Enterprise versions below 10.0.2
- Splunk Enterprise versions below 9.4.6
- Splunk Enterprise versions below 9.3.8
- Splunk Enterprise versions below 9.2.10
- Splunk Cloud Platform versions below 10.1.2507.10
- Splunk Cloud Platform versions below 10.0.2503.8
- Splunk Cloud Platform versions below 9.3.2411.120
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform. Additionally, organizations should implement strict access controls and user training to prevent phishing attempts. Regular security assessments and monitoring can also help identify and address potential exploitation attempts.