This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Splunk Enterprise fixes 2 vulnerabilities

Splunk fixes 6 vulnerabilities in Splunk Enterprise with versions 10.0.1, 9.4.4, 9.3.6 and 9.2.8 [1][2][3][4][5][6][7]. These versions also include fixes for third-party packages [7]. The most severe vulnerabilities are described below.

Splunk Enterprise - SSRF (CVE-2025-20371)
CVSS 7.5 (High)

An unauthenticated remote attacker can, by means of social engineering, carry out an SSRF attack and thereby gain unauthorized access to the REST API with a high level of privileges. Exploiting the vulnerability requires the "enableSplunkWebClientNetloc" option to be enabled in the web configuration [1].

The vulnerability is present in product:

  • Splunk Enterprise; >=10.0, <1O.0.1; >=9.4, <9.4.4; >=9.3, <9.3.6; >=9.2, <9.2.8;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 1. 10. 2025.

Splunk Enterprise - Improper Access Control (CVE-2025-20366)
CVSS 6.5 (Medium)

An authenticated remote attacker can gain unauthorized access to sensitive information from a background search that was run with administrator privileges. As a temporary fix, the web interface can be disabled [2].

The vulnerability is present in product:

  • Splunk Enterprise; >=9.4, <9.4.4; >=9.3, <9.3.6; >=9.2, <9.2.8;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 1. 10. 2025.

By CESNET, z.s.p.o. Martin Krajči on 2. 10. 2025.

CESNET, z.s.p.o. Logo