CVE-2025-20384: Unauthenticated Log Injection in Splunk Enterprise
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint. This may allow them to poison, forge, or obfuscate sensitive log data through specially crafted HTTP requests, potentially impacting log integrity and detection capabilities.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-20384?
CVE-2025-20384 has a high severity rating due to the potential for an unauthenticated attacker to inject ANSI escape codes.
How do I fix CVE-2025-20384?
To fix CVE-2025-20384, update to Splunk Enterprise version 10.0.1 or later, or Splunk Cloud Platform version 10.1.2507.4 or later.
What are the affected versions of Splunk for CVE-2025-20384?
Affected versions for CVE-2025-20384 include Splunk Enterprise versions below 10.0.1 and Splunk Cloud Platform versions below 10.1.2507.4.
Can CVE-2025-20384 be exploited remotely?
Yes, CVE-2025-20384 can be exploited remotely by an unauthenticated attacker.
What impact does CVE-2025-20384 have on system logs?
CVE-2025-20384 allows an attacker to inject malicious ANSI escape codes into Splunk log files, which can lead to log manipulation.