CVE-2025-20322
BaseFortify
Publication date: 2025-07-07
Last updated on: 2025-07-21
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| splunk | splunk | From 9.1.0 (inc) to 9.1.10 (exc) |
| splunk | splunk | From 9.2.0 (inc) to 9.2.7 (exc) |
| splunk | splunk | From 9.3.0 (inc) to 9.3.5 (exc) |
| splunk | splunk | From 9.4.0 (inc) to 9.4.3 (exc) |
| splunk | splunk_cloud_platform | From 9.2.2406 (inc) to 9.2.2406.119 (exc) |
| splunk | splunk_cloud_platform | From 9.3.2408 (inc) to 9.3.2408.113 (exc) |
| splunk | splunk_cloud_platform | From 9.3.2411 (inc) to 9.3.2411.104 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-20322 is a medium-severity vulnerability in Splunk Enterprise and Splunk Cloud Platform that allows an unauthenticated attacker to cause a denial of service (DoS) by sending a specially crafted SPL search command. This command triggers a rolling restart of the Search Head Cluster via a Cross-Site Request Forgery (CSRF) attack. The attacker must phish an administrator-level user to initiate the malicious request in their browser, as the attack requires user interaction and cannot be executed at will. [1]
How can this vulnerability impact me? :
This vulnerability can disrupt your Splunk service by causing a rolling restart of the Search Head Cluster, leading to a denial of service (DoS). This disruption can affect availability and continuity of your Splunk environment, especially if Search Head Clustering is enabled and Splunk Web is active. The attacker cannot exploit this without tricking an administrator-level user, but successful exploitation can interrupt normal operations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
No detection methods are currently provided for this vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, or 9.1.10, or upgrading Splunk Cloud Platform to the corresponding fixed versions 9.3.2411.104, 9.3.2408.113, or 9.2.2406.119. As a workaround, disabling Splunk Web can prevent exploitation of this vulnerability. [1]