CVE-2025-20370
BaseFortify
Publication date: 2025-10-01
Last updated on: 2025-10-08
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| splunk | splunk | From 9.2.0 (inc) to 9.2.8 (exc) |
| splunk | splunk | From 9.3.0 (inc) to 9.3.6 (exc) |
| splunk | splunk | From 9.4.0 (inc) to 9.4.4 (exc) |
| splunk | splunk | 10.0.0 |
| splunk | splunk_cloud_platform | From 9.2.2406 (inc) to 9.2.2406.123 (exc) |
| splunk | splunk_cloud_platform | From 9.3.2408 (inc) to 9.3.2408.118 (exc) |
| splunk | splunk_cloud_platform | From 9.3.2411 (inc) to 9.3.2411.108 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can cause high CPU usage on the affected Splunk server, which may result in a denial of service (DoS). This means the Splunk Enterprise instance could become unresponsive or unavailable until it is restarted, impacting availability of the service.
Can you explain this vulnerability to me?
This vulnerability exists in certain versions of Splunk Enterprise and Splunk Cloud Platform where a user with a role that has the high-privilege capability 'change_authentication' can send multiple LDAP bind requests to a specific internal endpoint. This causes high CPU usage on the server, potentially leading to a denial of service (DoS) until the Splunk instance is restarted.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or reviewing user roles that have the high-privilege capability `change_authentication` to prevent abuse, monitoring for unusual LDAP bind request activity to the internal endpoint, and upgrading Splunk Enterprise or Splunk Cloud Platform to versions 10.0.1, 9.4.4, 9.3.6, 9.2.8 or higher as applicable, where this vulnerability is fixed.