CVE-2025-20385

Published: Dec 3, 2025Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability `admin_all_objects` could craft a malicious payload through the href attribute of an anchor tag within a collection in the navigation bar, which could result in execution of unauthorized JavaScript code in the browser of a user.

Affected (7)

Products: Splunk: Splunk, Splunk Cloud Platform

Splunk

2 products

Splunk

Splunk Cloud Platform

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Splunk Splunk	From 10.0.0 to 10.0.2
Splunk Splunk	From 9.2.0 to 9.2.10
Splunk Splunk	From 9.3.0 to 9.3.8
Splunk Splunk	From 9.4.0 to 9.4.6
Splunk Splunk Cloud Platform	From 10.0.2503 to 10.0.2503.7
Splunk Splunk Cloud Platform	From 10.1.2507 to 10.1.2507.6
Splunk Splunk Cloud Platform	From 9.3.2411 to 9.3.2411.117

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://advisory.splunk.com/advisories/SVD-2025-1204

Source: psirt@cisco.com

Vendor Advisory

Timeline

No history available yet.