CVE-2025-20388 | THREATINT

Description

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.

PUBLISHED Reserved 2024-10-10 | Published 2025-12-03 | Updated 2025-12-03 | Assigner cisco

LOW: 2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Problem types

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Product status

10.0 (custom) before 10.0.1

affected

9.4 (custom) before 9.4.6

affected

9.3 (custom) before 9.3.8

affected

9.2 (custom) before 9.2.10

affected

10.1.2507 (custom) before 10.1.2507.4

affected

10.0.2503 (custom) before 10.0.2503.6

affected

9.3.2411 (custom) before 9.3.2411.116

affected

Credits

Mr Hack (try_to_hack) Santiago Lopez

References

advisory.splunk.com/advisories/SVD-2025-1207

cve.org (CVE-2025-20388)

nvd.nist.gov (CVE-2025-20388)

Download JSON