Vulnerability · Published Dec 3, 2025 · Assigned by cisco

CVE-2025-20388Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise

Low 2.7

In plain English

A low-severity server-side request forgery in Splunk Cloud Platform from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.4%top 68.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.

Affected products (as reported)

Vendor	Product	Versions
Splunk	Splunk Enterprise	10.0 – before 10.0.19.4 – before 9.4.69.3 – before 9.3.89.2 – before 9.2.10
Splunk	Splunk Cloud Platform	10.1.2507 – before 10.1.2507.410.0.2503 – before 10.0.2503.69.3.2411 – before 9.3.2411.116

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

https://advisory.splunk.com/advisories/SVD-2025-1207