CVE-2025-20388 — Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise

Description (CNA)

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 10.0 before 10.0.1; affected 9.4 before 9.4.6; affected 9.3 before 9.3.8; affected 9.2 before 9.2.10
Splunk / Splunk Cloud Platform	affected 10.1.2507 before 10.1.2507.4; affected 10.0.2503 before 10.0.2503.6; affected 9.3.2411 before 9.3.2411.116

CWE

CWE-918

References

https://advisory.splunk.com/advisories/SVD-2025-1207

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.