CVE-2025-20385: Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise

Q: What is the severity of CVE-2025-20385?

CVE-2025-20385 has been classified as a high severity vulnerability due to its potential to be exploited by users with elevated privileges.

Q: How do I fix CVE-2025-20385?

To remediate CVE-2025-20385, update Splunk Enterprise to version 10.0.2 or later, or Splunk Cloud Platform to version 10.1.2507.6 or later.

Q: Who is affected by CVE-2025-20385?

Users with the `admin_all_objects` role in affected versions of Splunk Enterprise and Splunk Cloud Platform are vulnerable to CVE-2025-20385.

Q: What type of attack is possible with CVE-2025-20385?

CVE-2025-20385 allows a high-privilege user to craft a malicious payload exploiting the href attribute in certain configurations.

Published Dec 3, 2025

Updated

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability adminallobjects could craft a malicious payload through the href attribute of an anchor tag within a collection in the navigation bar, which could result in execution of unauthorized JavaScript code in the browser of a user.

Affected Software

9 affected components

Splunk Enterprise<10.0.2, <9.4.6, <9.3.8, <9.2.10

Splunk Cloud Platform<10.1.2507.6, <10.0.2503.7, <9.3.2411.117

Splunk splunk>=9.2.0<9.2.10

Splunk splunk>=9.3.0<9.3.8

Splunk splunk>=9.4.0<9.4.6

Splunk splunk>=10.0.0<10.0.2

Splunk Splunk Cloud Platform>=9.3.2411<9.3.2411.117

Splunk Splunk Cloud Platform>=10.0.2503<10.0.2503.7

Splunk Splunk Cloud Platform>=10.1.2507<10.1.2507.6

Event History

Dec 3, 2025

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-20385?

CVE-2025-20385 has been classified as a high severity vulnerability due to its potential to be exploited by users with elevated privileges.

How do I fix CVE-2025-20385?

To remediate CVE-2025-20385, update Splunk Enterprise to version 10.0.2 or later, or Splunk Cloud Platform to version 10.1.2507.6 or later.

Who is affected by CVE-2025-20385?

Users with the `admin_all_objects` role in affected versions of Splunk Enterprise and Splunk Cloud Platform are vulnerable to CVE-2025-20385.

What versions are vulnerable to CVE-2025-20385?

Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117 are affected by CVE-2025-20385.

What type of attack is possible with CVE-2025-20385?