CVE-2025-20388 — Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a rol…
Published: 2025-12-03 · CVSS: 2.7 · CVSS 3.1
In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumerate internal IP addresses and network ports when adding new search peers to a Splunk search head in a distributed environment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7