CVE-2025-20371

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-20371", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.262Z", "datePublished": "2025-10-01T16:08:02.891Z", "dateUpdated": "2026-02-26T17:48:25.482Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "10.0", "status": "affected", "versionType": "custom", "lessThan": "10.0.1"}, {"version": "9.4", "status": "affected", "versionType": "custom", "lessThan": "9.4.4"}, {"version": "9.3", "status": "affected", "versionType": "custom", "lessThan": "9.3.6"}, {"version": "9.2", "status": "affected", "versionType": "custom", "lessThan": "9.2.8"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"version": "9.3.2411", "status": "affected", "versionType": "custom", "lessThan": "9.3.2411.109"}, {"version": "9.3.2408", "status": "affected", "versionType": "custom", "lessThan": "9.3.2408.119"}, {"version": "9.2.2406", "status": "affected", "versionType": "custom", "lessThan": "9.2.2406.122"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user."}], "value": "In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-1006"}], "title": "Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise", "datePublic": "2025-10-01T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.", "cweId": "CWE-918"}]}], "source": {"advisory": "SVD-2025-1006"}, "credits": [{"lang": "en", "value": "Alex Hordijk (hordalex)"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-10-01T16:08:02.891Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20371", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-02T03:55:48.000082Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:48:25.482Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20371", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-02T03:55:48.000082Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T17:22:40.832Z"}}], "cna": {"title": "Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise", "source": {"advisory": "SVD-2025-1006"}, "credits": [{"lang": "en", "value": "Alex Hordijk (hordalex)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.0", "lessThan": "10.0.1", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.4", "versionType": "custom"}, {"status": "affected", "version": "9.3", "lessThan": "9.3.6", "versionType": "custom"}, {"status": "affected", "version": "9.2", "lessThan": "9.2.8", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "9.3.2411", "lessThan": "9.3.2411.109", "versionType": "custom"}, {"status": "affected", "version": "9.3.2408", "lessThan": "9.3.2408.119", "versionType": "custom"}, {"status": "affected", "version": "9.2.2406", "lessThan": "9.2.2406.122", "versionType": "custom"}]}], "datePublic": "2025-10-01T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-1006"}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.", "supportingMedia": [{"type": "text/html", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-918", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination."}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-10-01T16:08:02.891Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20371", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:48:25.482Z", "dateReserved": "2024-10-10T19:15:13.262Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-10-01T16:08:02.891Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"lessThan": "10.0.1", "status": "affected", "version": "10.0", "versionType": "custom"}, {"lessThan": "9.4.4", "status": "affected", "version": "9.4", "versionType": "custom"}, {"lessThan": "9.3.6", "status": "affected", "version": "9.3", "versionType": "custom"}, {"lessThan": "9.2.8", "status": "affected", "version": "9.2", "versionType": "custom"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"lessThan": "9.3.2411.109", "status": "affected", "version": "9.3.2411", "versionType": "custom"}, {"lessThan": "9.3.2408.119", "status": "affected", "version": "9.3.2408", "versionType": "custom"}, {"lessThan": "9.2.2406.122", "status": "affected", "version": "9.2.2406", "versionType": "custom"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "724443E6-2DC9-4AB3-8E8F-D9BFBCC162E6", "versionEndExcluding": "9.2.8", "versionStartIncluding": "9.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "046659D8-1F48-4229-AC57-2A3B77D44442", "versionEndExcluding": "9.3.6", "versionStartIncluding": "9.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "88D2F283-10F9-4204-876A-9BEE75130E2C", "versionEndExcluding": "9.4.4", "versionStartIncluding": "9.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:10.0.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "259A3F4B-E4D2-48BC-9AE9-C37DE94987D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "DAA1E6F9-415D-4062-BC4E-4EDFA6F6A7CA", "versionEndExcluding": "9.2.2406.122", "versionStartIncluding": "9.2.2406", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "9BEB41CF-1F71-45BB-A434-984C16A2E174", "versionEndExcluding": "9.3.2408.119", "versionStartIncluding": "9.3.2408", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5075451-6D11-4EA8-9BB5-9BB27ECF8A40", "versionEndExcluding": "9.3.2411.109", "versionStartIncluding": "9.3.2411", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise anteriores a 10.0.1, 9.4.4, 9.3.6 y 9.2.8, y en las versiones de Splunk Cloud Platform anteriores a 9.3.2411.109, 9.3.2408.119 y 9.2.2406.122, un atacante no autenticado podr\u00eda desencadenar una falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) ciega, lo que podr\u00eda permitir a un atacante realizar llamadas a la API REST en nombre de un usuario autenticado con altos privilegios."}], "id": "CVE-2025-20371", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "psirt@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20371", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-02T03:55:48.000082Z", "version": "2.0.3"}}]}, "published": "2025-10-01T17:15:40.450", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2025-1006"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"created": "2025-10-02T08:38:49.393516+00:00", "updated": "2025-10-02T08:38:49.393576+00:00", "vendors": ["splunk", "splunk$PRODUCT$splunk", "splunk$PRODUCT$splunk_enterprise"]}