InfoSecBulletin Cybersecurity for mankind
Splunk issued security advisories for six vulnerabilities in Splunk Enterprise and Splunk Cloud Platform, with severity levels from medium to high. The issues include improper access control, various cross-site scripting (XSS) types, XML external entity (XXE) injection, denial-of-service (DoS) via LDAP misuse, and a high-severity server-side request forgery (SSRF).
CVE-2025-20366 (CVSS 6.5) – Improper Access Control in Background Job Submission
Daily Cyber security update for 14.11. 2026
Huge European telecom leak exposes clients of Swedbank, SEB, airBaltic, and other companies
PHP2Shell attack exploited a Check Point 0-day to deploy malware
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
The first advisory (SVD-2025-1001) details how “a low-privileged user that does not hold the ‘admin’ or ‘power’ Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job in the background.” By guessing the unique Search ID (SID), attackers could retrieve sensitive search results.
Fix: Upgrade to Splunk Enterprise 9.4.4, 9.3.6, or 9.2.8, or latest Splunk Cloud patches.
CVE-2025-20367 (CVSS 5.7) – Reflected Cross-Site Scripting (XSS)
In advisory SVD-2025-1002, Splunk disclosed that attackers could craft malicious payloads via the /app/search/table endpoint. The advisory warns: “a low-privileged user… could craft a malicious payload through the dataset.command parameter … resulting in execution of unauthorized JavaScript code in the browser of a user.”
Fix: Same patch versions as above for Enterprise and Cloud.
CVE-2025-20368 (CVSS 5.7) – Stored Cross-Site Scripting (XSS) in Saved Searches
Advisory SVD-2025-1003 highlights another XSS flaw: “a low privileged user … could craft a malicious payload through the error messages and job inspection details of a saved search.” This stored XSS could persistently affect multiple users reviewing saved search data.
Fix: Upgrade to patched versions of Splunk Enterprise and Cloud.
CVE-2025-20369 (CVSS 4.6) – XML External Entity Injection (XXE)
Advisory SVD-2025-1004 describes an XXE injection vulnerability in the dashboard tab label field. According to Splunk: “a low privilege user … could perform an XML external entity (XXE) injection … with the potential to cause denial of service (DoS) attacks.”
Fix: Upgrade to Splunk Enterprise 9.4.4 or higher, and Cloud hotfixes.
CVE-2025-20370 (CVSS 4.9) – DoS via Multiple LDAP Bind Requests
In SVD-2025-1005, Splunk identified a DoS risk caused by excessive LDAP bind requests: “a user who holds a role that contains the high-privilege capability change_authentication could send multiple LDAP bind requests … resulting in high server CPU usage.” This could crash the instance until restarted.
Fix: Upgrade to 10.0.1, 9.4.4, 9.3.6, or 9.2.8, or remove the change_authentication capability from user roles.
CVE-2025-20371 (CVSS 7.5) – Unauthenticated Blind SSRF
The most critical issue, SVD-2025-1006, involves a blind SSRF vulnerability: “an unauthenticated attacker could exploit this flaw to make server-side requests as if they were a privileged user.”
The advisory mentions that the exploit requires a specific setting to be enabled and may involve tricking the victim: “the attacker likely has to trick the victim into making a request from their browser.”
Fix: Upgrade to patched versions or set enableSplunkWebClientNetloc to false in web.conf.
Fixes and Upgrade Guidance
Splunk customers must update their deployments urgently. Some vulnerabilities need low-privileged or authenticated users, but the blind SSRF (CVE-2025-20371) carries a severe risk of privilege abuse and lateral movement.
