Skip to content
OpenAdvisories
High WID-SEC-2025-0647 20 CVEs

Splunk Splunk Enterprise: Mehrere Schwachstellen

Published Mar 26, 2025 · Updated Jul 9, 2026 · Revision 5 · de-DE

Vendor: Atlassian Vendor: IBM Vendor: Splunk Product: Bitbucket Product: Enterprise Product: Jira Product: SPSS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, Daten zu manipulieren, Code auszuführen, einen Denial-of-Service-Zustand zu verursachen und weitere, nicht spezifizierte Auswirkungen zu verursachen.

Product

Splunk Enterprise ermöglicht Monitoring und Analyse von Clickstream-Daten und Kundentransaktionen.

Vulnerabilities 20

  • Critical 10.0
    CVE-2024-38999

    jrburke requirejs vulnerable to prototype pollution

    jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

    py3.10-jupyterhub py3.13-jupyterhub py3.12-jupyterhub py3.11-jupyterhub Debian Ubuntu Wolfi npm
  • Critical 10.0
    CVE-2024-47875 Public exploit

    DOMPurify nesting-based mXSS

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

    cure53 DOMPurify cacti argo-workflows Debian Ubuntu Wolfi npm
  • High 8.0
    CVE-2025-20229 EPSS 16%

    Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remo…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.5
    CVE-2023-5363

    Incorrect cipher key & IV length processing

    Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2024-21090

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that ar…

    Oracle MySQL Connectors mysql-connector-python Ubuntu
  • High 7.5
    CVE-2024-21272

    MySQL Connector/Python connector takeover vulnerability

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). Supported versions that are affected are 9.0.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols…

    Oracle MySQL Connectors airflow mysql-connector-python Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2024-29857

    Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

    An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C# .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CP…

    druid tez bouncycastle bouncycastle Debian Ubuntu Wolfi Maven NuGet
  • High 7.3
    CVE-2024-45801

    Tampering by prototype polution in DOMPurify

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…

    cure53 DOMPurify argo-workflows dompurify Debian Ubuntu Wolfi npm
  • High 7.1
    CVE-2025-20231

    Sensitive Information Disclosure in Splunk Secure Gateway App

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 6.5
    CVE-2025-20228

    Maintenance mode state change of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Ke…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 6.2
    CVE-2024-3651 Public exploit

    Denial of Service via Quadratic Complexity in kjd/idna

    A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a…

    kjd kjd/idna katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.9
    CVE-2024-2511 EPSS 59%

    Unbounded memory growth with session handling in TLSv1.3

    Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.7
    CVE-2025-20226

    Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search wit…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2025-20232

    Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could ru…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.5
    CVE-2024-6923

    Email header injection due to unquoted newlines

    There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2024-4603

    Excessive time spent checking DSA keys and parameters

    Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Whe…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 4.3
    CVE-2025-20227

    Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20230

    Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and del…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 4.0
    CVE-2024-39338

    Server-Side Request Forgery in axios

    axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

    kubeflow-pipelines-apiserver lerna kubeflow-centraldashboard jitsucom-jitsu-console Debian Ubuntu Wolfi npm
  • Low 2.5
    CVE-2025-20233

    Incorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File Editing

    In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the `chmod` and `makedirs` Python functions in a way that resulted in overly broad read and execute permissions. This could lead to improper access control for a low-priv…

    Splunk Splunk App for Lookup File Editing

Revision history

  1. #5

    Neue Updates von IBM aufgenommen

  2. #4

    Neue Updates aufgenommen

  3. #3

    Neue Updates aufgenommen

  4. #2

    Neue Updates von Splunk-SVD aufgenommen

  5. #1

    Initiale Fassung

References