PT-2025-40270 · Splunk · Splunk Cloud Platform+1

Danylo Dmytriiev · Published 2025-10-01 · Updated 2025-10-02 · CVE-2025-20367

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.4.4 Splunk Enterprise versions prior to 9.3.6 Splunk Enterprise versions prior to 9.2.8 Splunk Cloud Platform versions prior to 9.3.2411.109 Splunk Cloud Platform versions prior to 9.3.2408.119 Splunk Cloud Platform versions prior to 9.2.2406.122

Description A user with limited privileges, lacking 'admin' or 'power' roles within Splunk, can create a malicious payload. This payload is delivered through the dataset.command parameter of the /app/search/table API endpoint. Successful exploitation allows the execution of unauthorized JavaScript code within a user's web browser.

Recommendations Update Splunk Enterprise to version 9.4.4 or later. Update Splunk Enterprise to version 9.3.6 or later. Update Splunk Enterprise to version 9.2.8 or later. Update Splunk Cloud Platform to version 9.3.2411.109 or later. Update Splunk Cloud Platform to version 9.3.2408.119 or later. Update Splunk Cloud Platform to version 9.2.2406.122 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-16044

CVE-2025-20367

Affected Products

Splunk Cloud Platform

Splunk Enterprise

References · 7

• https://advisory.splunk.com/advisories/SVD-2025-1002 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20367 · Security Note
• https://bdu.fstec.ru/vul/2025-16044 · Security Note
• https://reddit.com/r/pwnhub/comments/1nw7bly/serious_splunk_vulnerabilities_could_allow · Reddit Post
• https://twitter.com/CVEnew/status/1973429140414996509 · Twitter Post
• https://t.me/CVEtracker/33847 · Telegram Post