CVE-2025-20388

Published: Dec 3, 2025Modified: Jun 17, 2026

2.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.2 / Impact: 1.4

Source: psirt@cisco.com (Secondary)

Description

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.

Affected (7)

Products: Splunk: Splunk, Splunk Cloud Platform

Splunk

2 products

Splunk

Splunk Cloud Platform

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Splunk Splunk	From 9.2.0 to 9.2.10
Splunk Splunk	From 9.3.0 to 9.3.8
Splunk Splunk	From 9.4.0 to 9.4.6
Splunk Splunk	Version 10.0.0
Splunk Splunk Cloud Platform	From 10.0.2503 to 10.0.2503.6
Splunk Splunk Cloud Platform	From 10.1.2507 to 10.1.2507.4
Splunk Splunk Cloud Platform	From 9.3.2411 to 9.3.2411.116

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://advisory.splunk.com/advisories/SVD-2025-1207

Source: psirt@cisco.com

Vendor Advisory

Timeline

No history available yet.