CVE-2025-20379

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-20379", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.263Z", "datePublished": "2025-11-12T17:23:00.819Z", "dateUpdated": "2025-11-12T21:04:40.810Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "10.0", "status": "affected", "versionType": "custom", "lessThan": "10.0.1"}, {"version": "9.4", "status": "affected", "versionType": "custom", "lessThan": "9.4.5"}, {"version": "9.3", "status": "affected", "versionType": "custom", "lessThan": "9.3.7"}, {"version": "9.2", "status": "affected", "versionType": "custom", "lessThan": "9.2.9"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"version": "9.3.2411", "status": "affected", "versionType": "custom", "lessThan": "9.3.2411.116"}, {"version": "9.3.2408", "status": "affected", "versionType": "custom", "lessThan": "9.3.2408.124"}, {"version": "10.0.2503", "status": "affected", "versionType": "custom", "lessThan": "10.0.2503.5"}, {"version": "10.1.2507", "status": "affected", "versionType": "custom", "lessThan": "10.1.2507.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the \u201cadmin\u201c or \u201cpower\u201c Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands. They could bypass these safeguards on the \u201c/services/streams/search\u201c endpoint through its \u201cq\u201c parameter by circumventing endpoint restrictions using character encoding in the REST path. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will."}], "value": "In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the \u201cadmin\u201c or \u201cpower\u201c Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands. They could bypass these safeguards on the \u201c/services/streams/search\u201c endpoint through its \u201cq\u201c parameter by circumventing endpoint restrictions using character encoding in the REST path. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-1102"}], "title": "Risky command safeguards bypass using the \u201c/services/streams/search\u201c REST endpoint through \u201cq\u201c parameter in Splunk Enterprise", "datePublic": "2025-11-12T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.", "cweId": "CWE-200"}]}], "source": {"advisory": "SVD-2025-1102"}, "credits": [{"lang": "en", "value": "Anton (therceman)"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-11-12T17:23:00.819Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T20:47:25.092580Z", "id": "CVE-2025-20379", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T21:04:40.810Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20379", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T20:47:25.092580Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:47:26.582Z"}}], "cna": {"title": "Risky command safeguards bypass using the \u201c/services/streams/search\u201c REST endpoint through \u201cq\u201c parameter in Splunk Enterprise", "source": {"advisory": "SVD-2025-1102"}, "credits": [{"lang": "en", "value": "Anton (therceman)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.0", "lessThan": "10.0.1", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.5", "versionType": "custom"}, {"status": "affected", "version": "9.3", "lessThan": "9.3.7", "versionType": "custom"}, {"status": "affected", "version": "9.2", "lessThan": "9.2.9", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "9.3.2411", "lessThan": "9.3.2411.116", "versionType": "custom"}, {"status": "affected", "version": "9.3.2408", "lessThan": "9.3.2408.124", "versionType": "custom"}, {"status": "affected", "version": "10.0.2503", "lessThan": "10.0.2503.5", "versionType": "custom"}, {"status": "affected", "version": "10.1.2507", "lessThan": "10.1.2507.1", "versionType": "custom"}]}], "datePublic": "2025-11-12T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-1102"}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the \u201cadmin\u201c or \u201cpower\u201c Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands. They could bypass these safeguards on the \u201c/services/streams/search\u201c endpoint through its \u201cq\u201c parameter by circumventing endpoint restrictions using character encoding in the REST path. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.", "supportingMedia": [{"type": "text/html", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the \u201cadmin\u201c or \u201cpower\u201c Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands. They could bypass these safeguards on the \u201c/services/streams/search\u201c endpoint through its \u201cq\u201c parameter by circumventing endpoint restrictions using character encoding in the REST path. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-200", "description": "The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-11-12T17:23:00.819Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20379", "state": "PUBLISHED", "dateUpdated": "2025-11-12T21:04:40.810Z", "dateReserved": "2024-10-10T19:15:13.263Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-11-12T17:23:00.819Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"lessThan": "10.0.1", "status": "affected", "version": "10.0", "versionType": "custom"}, {"lessThan": "9.4.5", "status": "affected", "version": "9.4", "versionType": "custom"}, {"lessThan": "9.3.7", "status": "affected", "version": "9.3", "versionType": "custom"}, {"lessThan": "9.2.9", "status": "affected", "version": "9.2", "versionType": "custom"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"lessThan": "9.3.2411.116", "status": "affected", "version": "9.3.2411", "versionType": "custom"}, {"lessThan": "9.3.2408.124", "status": "affected", "version": "9.3.2408", "versionType": "custom"}, {"lessThan": "10.0.2503.5", "status": "affected", "version": "10.0.2503", "versionType": "custom"}, {"lessThan": "10.1.2507.1", "status": "affected", "version": "10.1.2507", "versionType": "custom"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "FE00218E-F8B2-42DA-9E4E-D7A00B657B93", "versionEndExcluding": "9.2.9", "versionStartIncluding": "9.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C6257ADA-AB6E-4679-A41B-BCE79CE8D573", "versionEndExcluding": "9.3.7", "versionStartIncluding": "9.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "30970DF3-6DA7-4FAB-B234-3226F47F9C87", "versionEndExcluding": "9.4.5", "versionStartIncluding": "9.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:10.0.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "259A3F4B-E4D2-48BC-9AE9-C37DE94987D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "C534EB53-D57A-4FB6-AC59-BDBFC451D892", "versionEndExcluding": "9.3.2408.124", "versionStartIncluding": "9.3.2408", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF33BD17-3D4D-47CC-A917-13AD9C777A47", "versionEndExcluding": "9.3.2411.116", "versionStartIncluding": "9.3.2411", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "E82D5593-83EE-4B20-ABDD-937AD94D6DB1", "versionEndExcluding": "10.0.2503.5", "versionStartIncluding": "10.0.2503", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "53675B00-D339-426F-AB65-AF70A983433D", "versionEndExcluding": "10.1.2507.1", "versionStartIncluding": "10.1.2507", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the \u201cadmin\u201c or \u201cpower\u201c Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands. They could bypass these safeguards on the \u201c/services/streams/search\u201c endpoint through its \u201cq\u201c parameter by circumventing endpoint restrictions using character encoding in the REST path. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise anteriores a la 10.0.1, 9.4.5, 9.3.7 y 9.2.9, y en las versiones de Splunk Cloud Platform anteriores a la 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 y 10.1.2507.1, un usuario con privilegios bajos que no posee los roles de Splunk \u201cadmin\u201d o \u201cpower\u201d podr\u00eda ejecutar una b\u00fasqueda guardada con un comando arriesgado utilizando los permisos de un usuario con privilegios m\u00e1s altos para eludir las salvaguardas de SPL para comandos arriesgados. Podr\u00edan eludir estas salvaguardas en el endpoint \u201c/services/streams/search\u201d a trav\u00e9s de su par\u00e1metro \u201cq\u201d circunvalando las restricciones del endpoint utilizando codificaci\u00f3n de caracteres en la ruta REST. La vulnerabilidad requiere que el atacante realice phishing a la v\u00edctima enga\u00f1\u00e1ndola para que inicie una solicitud dentro de su navegador. El usuario autenticado no deber\u00eda poder explotar la vulnerabilidad a voluntad."}], "id": "CVE-2025-20379", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "psirt@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20379", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T20:47:25.092580Z", "version": "2.0.3"}}]}, "published": "2025-11-12T18:15:35.030", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2025-1102"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"created": "2025-11-12T22:12:08.877820+00:00", "updated": "2025-11-12T22:12:08.877846+00:00", "vendors": ["splunk", "splunk$PRODUCT$splunk", "splunk$PRODUCT$splunk_enterprise"]}