PT-2025-28235 · Splunk · Splunk Cloud Platform+1
CVE-2025-20324
·
Publicado
2025-07-07
·
Atualizado
2025-07-07
CVSS v3.1
5.4
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Splunk Enterprise versions prior to 9.4.2
Splunk Enterprise versions prior to 9.3.5
Splunk Enterprise versions prior to 9.2.7
Splunk Enterprise versions prior to 9.1.10
Splunk Cloud Platform versions prior to 9.3.2411.104
Splunk Cloud Platform versions prior to 9.3.2408.113
Splunk Cloud Platform versions prior to 9.2.2406.119
Description:
A low-privileged user without the "admin" or "power" Splunk roles could create or overwrite system source type configurations by sending a specially-crafted payload to the "/servicesNS/nobody/search/admin/sourcetypes/" REST endpoint on the Splunk management port.
Recommendations:
For Splunk Enterprise versions prior to 9.4.2, update to version 9.4.2 or later.
For Splunk Enterprise versions prior to 9.3.5, update to version 9.3.5 or later.
For Splunk Enterprise versions prior to 9.2.7, update to version 9.2.7 or later.
For Splunk Enterprise versions prior to 9.1.10, update to version 9.1.10 or later.
For Splunk Cloud Platform versions prior to 9.3.2411.104, update to version 9.3.2411.104 or later.
For Splunk Cloud Platform versions prior to 9.3.2408.113, update to version 9.3.2408.113 or later.
For Splunk Cloud Platform versions prior to 9.2.2406.119, update to version 9.2.2406.119 or later.
As a temporary workaround, consider restricting access to the "/servicesNS/nobody/search/admin/sourcetypes/" REST endpoint on the Splunk management port until a patch is available.
Correção
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Splunk Cloud Platform
Splunk Enterprise