CVE-2025-20324 — Improper Access Control in System Source Types Configuration in Splunk Enterprise

Description (CNA)

In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite [system source type](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-source-types/create-source-types) configurations by sending a specially-crafted payload to the `/servicesNS/nobody/search/admin/sourcetypes/` REST endpoint on the Splunk management port.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 9.4 before 9.4.2; affected 9.3 before 9.3.5; affected 9.2 before 9.2.7; affected 9.1 before 9.1.10
Splunk / Splunk Enterprise Cloud	affected 9.3.2411 before 9.3.2411.104; affected 9.3.2408 before 9.3.2408.113; affected 9.2.2406 before 9.2.2406.119

CWE

CWE-284

References

https://advisory.splunk.com/advisories/SVD-2025-0707

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.