Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user with the high privilege capability change_authentication could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.7 | CVE-2025-20388 |
Exploitation
To exploit this vulnerability, an attacker must have a role that includes the high privilege capability change_authentication. Once this privilege is obtained, the attacker can add new search peers to the Splunk search head, allowing them to enumerate internal IP addresses and network ports, potentially leading to further attacks within the network.
Affected Products
- Splunk Enterprise versions below 10.0.1
- Splunk Enterprise versions below 9.4.6
- Splunk Enterprise versions below 9.3.8
- Splunk Enterprise versions below 9.2.10
- Splunk Cloud Platform versions below 10.1.2507.4
- Splunk Cloud Platform versions below 10.0.2503.7
- Splunk Cloud Platform versions below 9.3.2411.116
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform that are not affected by this issue. Additionally, organizations should review user roles and permissions to ensure that only trusted users have high privilege capabilities.