CVE-2025-20371 — Unauthenticated Blind Server Side Request Forgery (SSRF) in Splunk Enterprise

Description (CNA)

In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 10.0 before 10.0.1; affected 9.4 before 9.4.4; affected 9.3 before 9.3.6; affected 9.2 before 9.2.8
Splunk / Splunk Cloud Platform	affected 9.3.2411 before 9.3.2411.109; affected 9.3.2408 before 9.3.2408.119; affected 9.2.2406 before 9.2.2406.122

CWE

CWE-918

References

https://advisory.splunk.com/advisories/SVD-2025-1006

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.