CVE-2025-20378

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the `return_to` parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious URL, it could cause an unvalidated redirect to an external malicious site. To be successful, the attacker has to trick the victim into initiating a request from their browser. The unauthenticated attacker should not be able to exploit the vulnerability at will.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2025-1101	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:10.0.0::::enterprise:::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) En las versiones de Splunk Enterprise anteriores a 10.0.1, 9.4.5, 9.3.7, 9.2.9, y las versiones de Splunk Cloud Platform anteriores a 10.0.2503.5, 9.3.2411.111 y 9.3.2408.121, un atacante no autenticado podría crear una URL maliciosa utilizando el parámetro 'return_to' del endpoint de inicio de sesión de Splunk Web. Cuando un usuario autenticado visita la URL maliciosa, podría causar una redirección no validada a un sitio malicioso externo. Para tener éxito, el atacante tiene que engañar a la víctima para que inicie una solicitud desde su navegador. El atacante no autenticado no debería poder explotar la vulnerabilidad a voluntad.

Information

Published : 2025-11-12 18:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-20378

Mitre link : CVE-2025-20378

CVE.ORG link : CVE-2025-20378

JSON object : View

Products Affected

splunk

splunk_cloud_platform
splunk

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2025-20378", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20378", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T20:47:32.175559Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.0", "lessThan": "10.0.1", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.5", "versionType": "custom"}, {"status": "affected", "version": "9.3", "lessThan": "9.3.7", "versionType": "custom"}, {"status": "affected", "version": "9.2", "lessThan": "9.2.9", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "10.0.2503", "lessThan": "10.0.2503.5", "versionType": "custom"}, {"status": "affected", "version": "9.3.2411", "lessThan": "9.3.2411.111", "versionType": "custom"}, {"status": "affected", "version": "9.3.2408", "lessThan": "9.3.2408.121", "versionType": "custom"}]}]}], "published": "2025-11-12T18:15:34.847", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-1101", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the `return_to` parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious URL, it could cause an unvalidated redirect to an external malicious site. To be successful, the attacker has to trick the victim into initiating a request from their browser. The unauthenticated attacker should not be able to exploit the vulnerability at will."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise anteriores a 10.0.1, 9.4.5, 9.3.7, 9.2.9, y las versiones de Splunk Cloud Platform anteriores a 10.0.2503.5, 9.3.2411.111 y 9.3.2408.121, un atacante no autenticado podr\u00eda crear una URL maliciosa utilizando el par\u00e1metro 'return_to' del endpoint de inicio de sesi\u00f3n de Splunk Web. Cuando un usuario autenticado visita la URL maliciosa, podr\u00eda causar una redirecci\u00f3n no validada a un sitio malicioso externo. Para tener \u00e9xito, el atacante tiene que enga\u00f1ar a la v\u00edctima para que inicie una solicitud desde su navegador. El atacante no autenticado no deber\u00eda poder explotar la vulnerabilidad a voluntad."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "FE00218E-F8B2-42DA-9E4E-D7A00B657B93", "versionEndExcluding": "9.2.9", "versionStartIncluding": "9.2.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "C6257ADA-AB6E-4679-A41B-BCE79CE8D573", "versionEndExcluding": "9.3.7", "versionStartIncluding": "9.3.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "30970DF3-6DA7-4FAB-B234-3226F47F9C87", "versionEndExcluding": "9.4.5", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:10.0.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "259A3F4B-E4D2-48BC-9AE9-C37DE94987D5"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97D8397F-D372-4481-901A-0BC282B09DD7", "versionEndExcluding": "9.3.2408.121", "versionStartIncluding": "9.3.2408"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F134529C-FFD7-4B2F-AE4C-6DEA847F4714", "versionEndExcluding": "9.3.2411.111", "versionStartIncluding": "9.3.2411"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E82D5593-83EE-4B20-ABDD-937AD94D6DB1", "versionEndExcluding": "10.0.2503.5", "versionStartIncluding": "10.0.2503"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}