CVE-2025-20322
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Summary
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an unauthenticated attacker could send a specially-crafted SPL search command that could trigger a rolling restart in the Search Head Cluster through a Cross-Site Request Forgery (CSRF), potentially leading to a denial of service (DoS).<br><br>The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.<br><br>See How rolling restart works for more information.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Splunk | Splunk Enterprise | 9.4 < 9.4.3 | affected |
| Splunk | Splunk Enterprise | 9.3 < 9.3.5 | affected |
| Splunk | Splunk Enterprise | 9.2 < 9.2.7 | affected |
| Splunk | Splunk Enterprise | 9.1 < 9.1.10 | affected |
| Splunk | Splunk Enterprise Cloud | 9.3.2411 < 9.3.2411.104 | affected |
| Splunk | Splunk Enterprise Cloud | 9.3.2408 < 9.3.2408.113 | affected |
| Splunk | Splunk Enterprise Cloud | 9.2.2406 < 9.2.2406.119 | affected |
Weaknesses
- CWE-352: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.