Home

Description

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint. This may allow them to poison, forge, or obfuscate sensitive log data through specially crafted HTTP requests, potentially impacting log integrity and detection capabilities.

PUBLISHED Reserved 2024-10-10 | Published 2025-12-03 | Updated 2025-12-03 | Assigner cisco




MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Problem types

The software does not neutralize or incorrectly neutralizes output that is written to logs.

Product status

10.0 (custom) before 10.0.1
affected

9.4 (custom) before 9.4.6
affected

9.3 (custom) before 9.3.8
affected

9.2 (custom) before 9.2.10
affected

10.1.2507 (custom) before 10.1.2507.4
affected

10.0.2503 (custom) before 10.0.2503.6
affected

9.3.2411 (custom) before 9.3.2411.117
affected

Credits

STÖK / Fredrik Alexandersson

References

advisory.splunk.com/advisories/SVD-2025-1203

cve.org (CVE-2025-20384)

nvd.nist.gov (CVE-2025-20384)