Skip to content
OpenAdvisories
High NCSC-2025-0212 8 CVEs

Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

Published Jul 8, 2025 · Updated Jul 8, 2025 · nl

Vendor: Splunk Product: Enterprise

Summary

Splunk heeft kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform.

Details

Interpretaties
De kwetsbaarheden in Splunk Enterprise en Splunk Cloud Platform stellen zowel low-privileged als high-privileged gebruikers in staat om ongeautoriseerde acties uit te voeren, zoals het onderdrukken van waarschuwingen, het uitvoeren van externe commando's, en het veroorzaken van een denial-of-service. Daarnaast kunnen ongeauthenticeerde aanvallers kwetsbaarheden misbruiken om wijzigingen aan te brengen in de lidmaatschapsconfiguraties van een Splunk Search Head Cluster of om gevoelige informatie bloot te stellen. De exploitatie van deze kwetsbaarheden vereist vaak sociale-engineeringtechnieken, wat de noodzaak van waakzaamheid onder gebruikers benadrukt.

Oplossingen
Splunk heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 8

  • Medium 6.8
    CVE-2025-20319

    Remote Command Execution through Scripted Input Files in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `list_inputs` capability , could perform a remote command execution due to improper user input sanitiz…

    Splunk Splunk Enterprise
  • Medium 6.5
    CVE-2025-20321

    Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership sta…

    Splunk Splunk Enterprise Splunk Enterprise Cloud
  • Medium 6.3
    CVE-2025-20320

    Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious pay…

    Splunk Splunk Enterprise Splunk Enterprise Cloud
  • Medium 5.4
    CVE-2025-20324

    Improper Access Control in System Source Types Configuration in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite […

    Splunk Splunk Enterprise Splunk Enterprise Cloud
  • Medium 4.3
    CVE-2025-20300

    Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles, and has read-only access to…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20322

    Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a roll…

    Splunk Splunk Enterprise Splunk Enterprise Cloud
  • Medium 4.3
    CVE-2025-20323

    Missing Access Control of Saved Searches in the Splunk Archiver app

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn off the scheduled search `Bucket Copy Trigger` within the Splunk Archiver application. This is because…

    Splunk Splunk Enterprise
  • Low 3.1
    CVE-2025-20325

    Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster [splunk.secret](https://help.splunk.com/en/spl…

    Splunk Splunk Enterprise Splunk Cloud Platform

Revision history

  1. #1.0.0

    Initiele versie

References