CVE-2025-20388 - Vulnerability Details - OpenCVE

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Splunk	Splunk Cloud Platform Splunk Enterprise

No data.

No data.

References

Link	Providers
https://advisory.splunk.com/advisories/SVD-2025-1207

History

Thu, 04 Dec 2025 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Splunk Splunk splunk Cloud Platform Splunk splunk Enterprise
Vendors & Products		Splunk Splunk splunk Cloud Platform Splunk splunk Enterprise

Wed, 03 Dec 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 03 Dec 2025 17:15:00 +0000

Type	Values Removed	Values Added
Description		In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.
Title		Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise
Weaknesses		CWE-918
References		https://advisory.splunk.com/advisories/SVD-2025-1207
Metrics		cvssV3_1 `{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2025-12-03T17:00:59.450Z

Updated: 2025-12-03T18:14:46.236Z

Reserved: 2024-10-10T19:15:13.265Z

Link: CVE-2025-20388

Vulnrichment

Updated: 2025-12-03T18:12:37.752Z

NVD

Status : Awaiting Analysis

Published: 2025-12-03T17:15:51.427

Modified: 2025-12-04T17:15:08.283

Link: CVE-2025-20388

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-20388", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.265Z", "datePublished": "2025-12-03T17:00:59.450Z", "dateUpdated": "2025-12-03T18:14:46.236Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "10.0", "status": "affected", "versionType": "custom", "lessThan": "10.0.1"}, {"version": "9.4", "status": "affected", "versionType": "custom", "lessThan": "9.4.6"}, {"version": "9.3", "status": "affected", "versionType": "custom", "lessThan": "9.3.8"}, {"version": "9.2", "status": "affected", "versionType": "custom", "lessThan": "9.2.10"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"version": "10.1.2507", "status": "affected", "versionType": "custom", "lessThan": "10.1.2507.4"}, {"version": "10.0.2503", "status": "affected", "versionType": "custom", "lessThan": "10.0.2503.6"}, {"version": "9.3.2411", "status": "affected", "versionType": "custom", "lessThan": "9.3.2411.116"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment."}], "value": "In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-1207"}], "title": "Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise", "datePublic": "2025-12-03T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "baseScore": 2.7, "baseSeverity": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.", "cweId": "CWE-918"}]}], "source": {"advisory": "SVD-2025-1207"}, "credits": [{"lang": "en", "value": "Mr Hack (try_to_hack) Santiago Lopez"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-12-03T17:00:59.450Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T18:12:35.294523Z", "id": "CVE-2025-20388", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T18:14:46.236Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20388", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T18:12:35.294523Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T18:12:37.752Z"}}], "cna": {"title": "Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise", "source": {"advisory": "SVD-2025-1207"}, "credits": [{"lang": "en", "value": "Mr Hack (try_to_hack) Santiago Lopez"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.0", "lessThan": "10.0.1", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.6", "versionType": "custom"}, {"status": "affected", "version": "9.3", "lessThan": "9.3.8", "versionType": "custom"}, {"status": "affected", "version": "9.2", "lessThan": "9.2.10", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "10.1.2507", "lessThan": "10.1.2507.4", "versionType": "custom"}, {"status": "affected", "version": "10.0.2503", "lessThan": "10.0.2503.6", "versionType": "custom"}, {"status": "affected", "version": "9.3.2411", "lessThan": "9.3.2411.116", "versionType": "custom"}]}], "datePublic": "2025-12-03T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-1207"}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.", "supportingMedia": [{"type": "text/html", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-918", "description": "The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination."}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-12-03T17:00:59.450Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20388", "state": "PUBLISHED", "dateUpdated": "2025-12-03T18:14:46.236Z", "dateReserved": "2024-10-10T19:15:13.265Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-12-03T17:00:59.450Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}