InfoSecBulletin Cybersecurity for mankind
Splunk issued security advisories for six vulnerabilities in Splunk Enterprise and Splunk Cloud Platform, with severity levels from medium to high. The issues include improper access control, various cross-site scripting (XSS) types, XML external entity (XXE) injection, denial-of-service (DoS) via LDAP misuse, and a high-severity server-side request forgery (SSRF).
CVE-2025-20366 (CVSS 6.5) – Improper Access Control in Background Job Submission
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
The first advisory (SVD-2025-1001) details how “a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background.” By guessing the unique Search ID (SID), attackers could retrieve sensitive search results.
Fix: Upgrade to Splunk Enterprise 9.4.4, 9.3.6, or 9.2.8, or latest Splunk Cloud patches.
CVE-2025-20367 (CVSS 5.7) – Reflected Cross-Site Scripting (XSS)
In advisory SVD-2025-1002, Splunk disclosed that attackers could craft malicious payloads via the /app/search/table endpoint. The advisory warns: “a low-privileged user… could craft a malicious payload through the dataset.command parameter … resulting in execution of unauthorized JavaScript code in the browser of a user.”
Fix: Same patch versions as above for Enterprise and Cloud.
CVE-2025-20368 (CVSS 5.7) – Stored Cross-Site Scripting (XSS) in Saved Searches
Advisory SVD-2025-1003 highlights another XSS flaw: “a low privileged user … could craft a malicious payload through the error messages and job inspection details of a saved search.” This stored XSS could persistently affect multiple users reviewing saved search data.
Fix: Upgrade to patched versions of Splunk Enterprise and Cloud.
CVE-2025-20369 (CVSS 4.6) – XML External Entity Injection (XXE)
Advisory SVD-2025-1004 describes an XXE injection vulnerability in the dashboard tab label field. According to Splunk: “a low privilege user … could perform an XML external entity (XXE) injection … with the potential to cause denial of service (DoS) attacks.”
Fix: Upgrade to Splunk Enterprise 9.4.4 or higher, and Cloud hotfixes.
CVE-2025-20370 (CVSS 4.9) – DoS via Multiple LDAP Bind Requests
In SVD-2025-1005, Splunk identified a DoS risk caused by excessive LDAP bind requests: “a user who holds a role that contains the high-privilege capability change_authentication could send multiple LDAP bind requests … resulting in high server CPU usage.” This could crash the instance until restarted.
Fix: Upgrade to 10.0.1, 9.4.4, 9.3.6, or 9.2.8, or remove the change_authentication capability from user roles.
CVE-2025-20371 (CVSS 7.5) – Unauthenticated Blind SSRF
The most critical issue, SVD-2025-1006, involves a blind SSRF vulnerability: “an unauthenticated attacker could exploit this flaw to make server-side requests as if they were a privileged user.”
The advisory mentions that the exploit requires a specific setting to be enabled and may involve tricking the victim: “the attacker likely has to trick the victim into making a request from their browser.”
Fix: Upgrade to patched versions or set enableSplunkWebClientNetloc to false in web.conf.
Fixes and Upgrade Guidance
Splunk customers must update their deployments urgently. Some vulnerabilities need low-privileged or authenticated users, but the blind SSRF (CVE-2025-20371) carries a severe risk of privilege abuse and lateral movement.
