Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user with high privilege capability admin_all_objects could craft a malicious payload through the href attribute of an anchor tag. This could lead to the execution of unauthorized JavaScript code in the browser of a user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.4 | CVE-2025-20385 |
Exploitation
To exploit this vulnerability, an attacker with the admin_all_objects privilege can create a malicious link that, when clicked by a user, executes unauthorized JavaScript code in their browser. This requires the user to interact with the crafted link, making user interaction a key component of the exploitation process.
Affected Products
- Splunk Enterprise versions below 10.0.2
- Splunk Enterprise versions below 9.4.6
- Splunk Enterprise versions below 9.3.8
- Splunk Enterprise versions below 9.2.10
- Splunk Cloud Platform versions below 10.1.2507.6
- Splunk Cloud Platform versions below 10.0.2503.7
- Splunk Cloud Platform versions below 9.3.2411.117
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform that are not affected by this issue. Additionally, limiting the privileges of users and monitoring for suspicious activity can help reduce the risk of exploitation.