InfoSecBulletin Cybersecurity for mankind
Splunk issued security advisories for six vulnerabilities in Splunk Enterprise and Splunk Cloud Platform, with severity levels from medium to high. The issues include improper access control, various cross-site scripting (XSS) types, XML external entity (XXE) injection, denial-of-service (DoS) via LDAP misuse, and a high-severity server-side request forgery (SSRF).
CVE-2025-20366 (CVSS 6.5) – Improper Access Control in Background Job Submission
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The first advisory (SVD-2025-1001) details how “a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background.” By guessing the unique Search ID (SID), attackers could retrieve sensitive search results.
Fix: Upgrade to Splunk Enterprise 9.4.4, 9.3.6, or 9.2.8, or latest Splunk Cloud patches.
CVE-2025-20367 (CVSS 5.7) – Reflected Cross-Site Scripting (XSS)
In advisory SVD-2025-1002, Splunk disclosed that attackers could craft malicious payloads via the /app/search/table endpoint. The advisory warns: “a low-privileged user… could craft a malicious payload through the dataset.command parameter … resulting in execution of unauthorized JavaScript code in the browser of a user.”
Fix: Same patch versions as above for Enterprise and Cloud.
CVE-2025-20368 (CVSS 5.7) – Stored Cross-Site Scripting (XSS) in Saved Searches
Advisory SVD-2025-1003 highlights another XSS flaw: “a low privileged user … could craft a malicious payload through the error messages and job inspection details of a saved search.” This stored XSS could persistently affect multiple users reviewing saved search data.
Fix: Upgrade to patched versions of Splunk Enterprise and Cloud.
CVE-2025-20369 (CVSS 4.6) – XML External Entity Injection (XXE)
Advisory SVD-2025-1004 describes an XXE injection vulnerability in the dashboard tab label field. According to Splunk: “a low privilege user … could perform an XML external entity (XXE) injection … with the potential to cause denial of service (DoS) attacks.”
Fix: Upgrade to Splunk Enterprise 9.4.4 or higher, and Cloud hotfixes.
CVE-2025-20370 (CVSS 4.9) – DoS via Multiple LDAP Bind Requests
In SVD-2025-1005, Splunk identified a DoS risk caused by excessive LDAP bind requests: “a user who holds a role that contains the high-privilege capability change_authentication could send multiple LDAP bind requests … resulting in high server CPU usage.” This could crash the instance until restarted.
Fix: Upgrade to 10.0.1, 9.4.4, 9.3.6, or 9.2.8, or remove the change_authentication capability from user roles.
CVE-2025-20371 (CVSS 7.5) – Unauthenticated Blind SSRF
The most critical issue, SVD-2025-1006, involves a blind SSRF vulnerability: “an unauthenticated attacker could exploit this flaw to make server-side requests as if they were a privileged user.”
The advisory mentions that the exploit requires a specific setting to be enabled and may involve tricking the victim: “the attacker likely has to trick the victim into making a request from their browser.”
Fix: Upgrade to patched versions or set enableSplunkWebClientNetloc to false in web.conf.
Fixes and Upgrade Guidance
Splunk customers must update their deployments urgently. Some vulnerabilities need low-privileged or authenticated users, but the blind SSRF (CVE-2025-20371) carries a severe risk of privilege abuse and lateral movement.
