Vulnerability · Published Jul 7, 2025 · Assigned by cisco
CVE-2025-20324Improper Access Control in System Source Types Configuration in Splunk Enterprise
Medium 5.4
In plain English
A medium-severity improper access control in Splunk Enterprise from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite [system source type](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-source-types/create-source-types) configurations by sending a specially-crafted payload to the `/servicesNS/nobody/search/admin/sourcetypes/` REST endpoint on the Splunk management port.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 9.4 – before 9.4.29.3 – before 9.3.59.2 – before 9.2.79.1 – before 9.1.10 |
| Splunk | Splunk Enterprise Cloud | 9.3.2411 – before 9.3.2411.1049.3.2408 – before 9.3.2408.1139.2.2406 – before 9.2.2406.119 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N