CVE-2025-20320
BaseFortify
Publication date: 2025-07-07
Last updated on: 2025-07-21
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| splunk | splunk | From 9.1.0 (inc) to 9.1.10 (exc) |
| splunk | splunk | From 9.2.0 (inc) to 9.2.7 (exc) |
| splunk | splunk | From 9.3.0 (inc) to 9.3.5 (exc) |
| splunk | splunk | From 9.4.0 (inc) to 9.4.3 (exc) |
| splunk | splunk_cloud_platform | From 9.2.2406 (inc) to 9.2.2406.121 (exc) |
| splunk | splunk_cloud_platform | From 9.3.2408 (inc) to 9.3.2408.117 (exc) |
| splunk | splunk_cloud_platform | From 9.3.2411 (inc) to 9.3.2411.107 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-35 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
If exploited, this vulnerability can cause a denial of service (DoS) by deleting arbitrary files within the Splunk directory. This can disrupt the normal operation of Splunk services, potentially leading to downtime or loss of functionality until the affected files are restored or the system is repaired. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
No specific detection methods or commands for identifying this vulnerability on a network or system are provided in the available resources. [1]
Can you explain this vulnerability to me?
This vulnerability is a path traversal flaw in Splunk Enterprise and Splunk Cloud Platform's 'User Interface - Views' configuration page. It allows a low-privileged user, who does not have 'admin' or 'power' roles, to craft a malicious payload that can delete arbitrary files within a Splunk directory. However, the low-privileged user cannot exploit this vulnerability directly; they must trick an administrator-level user into initiating a request in their browser (social engineering). Successful exploitation can lead to a denial of service (DoS) condition. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, or 9.1.10, or upgrading Splunk Cloud Platform to versions 9.3.2411.107, 9.3.2408.117, or 9.2.2406.121. As a workaround, disabling Splunk Web can reduce exposure to the vulnerability until upgrades are applied. [1]