CVE-2025-20388: Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability changeauthentication could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-20388?
CVE-2025-20388 is classified as a high-severity vulnerability due to its potential impact on network security.
How do I fix CVE-2025-20388?
To fix CVE-2025-20388, upgrade to Splunk Enterprise version 10.0.1 or later, or Splunk Cloud Platform version 10.1.2507.4 or later.
What versions are affected by CVE-2025-20388?
CVE-2025-20388 affects Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, as well as Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116.
What capabilities are exploited in CVE-2025-20388?
CVE-2025-20388 can be exploited by users with the `change_authentication` capability, allowing them to enumerate internal IP addresses.
What are the risks of CVE-2025-20388?
The risks of CVE-2025-20388 include potential exposure of internal network details, which can lead to further attacks or unauthorized access.