vulnerability
Splunk: CVE-2025-20388: Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 3 | (AV:N/AC:L/Au:M/C:P/I:N/A:N) | Dec 3, 2025 | Dec 4, 2025 | Dec 4, 2025 |
Severity
3
CVSS
(AV:N/AC:L/Au:M/C:P/I:N/A:N)
Published
Dec 3, 2025
Added
Dec 4, 2025
Modified
Dec 4, 2025
Description
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capabilitychange_authenticationcould enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.SeeDefine roles on the Splunk platform with capabilities.
Solution
splunk-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.