PT-2025-48957 · Splunk · Splunk Cloud Platform+1

Published 2025-12-03 · Updated 2025-12-05 · CVE-2025-20385

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.0.2, 9.4.6, 9.3.8, and 9.2.10 Splunk Cloud Platform versions prior to 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117

Description A user with the admin all objects privilege capability could potentially execute unauthorized JavaScript code in a user's browser. This is possible by crafting a malicious payload through the href attribute of an anchor tag within a collection in the navigation bar.

Recommendations Update Splunk Enterprise to version 10.0.2 or later. Update Splunk Enterprise to version 9.4.6 or later. Update Splunk Enterprise to version 9.3.8 or later. Update Splunk Enterprise to version 9.2.10 or later. Update Splunk Cloud Platform to version 10.1.2507.6 or later. Update Splunk Cloud Platform to version 10.0.2503.7 or later. Update Splunk Cloud Platform to version 9.3.2411.117 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-16296

CVE-2025-20385

Affected Products

Splunk Cloud Platform

Splunk Enterprise

References · 7

• https://advisory.splunk.com/advisories/SVD-2025-1204 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20385 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16296 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-20385 · Security Note
• https://twitter.com/CVEnew/status/1996268273436877047 · Twitter Post
• https://twitter.com/dailycve/status/1997047348380553384 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2025120404 · Note