CVE-2025-20384

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint. This may allow them to poison, forge, or obfuscate sensitive log data through specially crafted HTTP requests, potentially impacting log integrity and detection capabilities.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2025-1203	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:10.0.0::::enterprise:::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::

History

25 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En las versiones de Splunk Enterprise anteriores a 10.0.1, 9.4.6, 9.3.8 y 9.2.10, y en las versiones de Splunk Cloud Platform anteriores a 10.1.2507.4, 10.0.2503.6 y 9.3.2411.117.125, un atacante no autenticado puede inyectar códigos de escape del American National Standards Institute (ANSI) en los archivos de registro de Splunk debido a una validación incorrecta en el endpoint web /en-US/static/. Esto puede permitirles envenenar, falsificar u ofuscar datos de registro sensibles a través de solicitudes HTTP especialmente diseñadas, lo que podría afectar la integridad de los registros y las capacidades de detección.

Information

Published : 2025-12-03 17:15

Updated : 2026-09-25 23:10

NVD link : CVE-2025-20384

Mitre link : CVE-2025-20384

CVE.ORG link : CVE-2025-20384

JSON object : View

Products Affected

splunk

splunk_cloud_platform
splunk

CWE

CWE-117

Improper Output Neutralization for Logs

{"id": "CVE-2025-20384", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20384", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T21:32:13.797275Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "10.0", "lessThan": "10.0.1", "versionType": "custom"}, {"status": "affected", "version": "9.4", "lessThan": "9.4.6", "versionType": "custom"}, {"status": "affected", "version": "9.3", "lessThan": "9.3.8", "versionType": "custom"}, {"status": "affected", "version": "9.2", "lessThan": "9.2.10", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "10.1.2507", "lessThan": "10.1.2507.4", "versionType": "custom"}, {"status": "affected", "version": "10.0.2503", "lessThan": "10.0.2503.6", "versionType": "custom"}, {"status": "affected", "version": "9.3.2411", "lessThan": "9.3.2411.117", "versionType": "custom"}]}]}], "published": "2025-12-03T17:15:50.740", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-1203", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-117"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint. This may allow them to poison, forge, or obfuscate sensitive log data through specially crafted HTTP requests, potentially impacting log integrity and detection capabilities."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise anteriores a 10.0.1, 9.4.6, 9.3.8 y 9.2.10, y en las versiones de Splunk Cloud Platform anteriores a 10.1.2507.4, 10.0.2503.6 y 9.3.2411.117.125, un atacante no autenticado puede inyectar c\u00f3digos de escape del American National Standards Institute (ANSI) en los archivos de registro de Splunk debido a una validaci\u00f3n incorrecta en el endpoint web /en-US/static/. Esto puede permitirles envenenar, falsificar u ofuscar datos de registro sensibles a trav\u00e9s de solicitudes HTTP especialmente dise\u00f1adas, lo que podr\u00eda afectar la integridad de los registros y las capacidades de detecci\u00f3n."}], "lastModified": "2026-09-25T23:10:00.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "AE8BF109-2B9C-4C50-AC9F-10A45456FD75", "versionEndExcluding": "9.2.10", "versionStartIncluding": "9.2.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "05D6973D-D965-42D3-8320-AF4A4B424E6C", "versionEndExcluding": "9.3.8", "versionStartIncluding": "9.3.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "8571F470-6AE1-4737-B1FA-49121E426AF2", "versionEndExcluding": "9.4.6", "versionStartIncluding": "9.4.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:10.0.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "259A3F4B-E4D2-48BC-9AE9-C37DE94987D5"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "055D722F-3C2C-45FF-B44F-FD73820F2A78", "versionEndExcluding": "9.3.2411.117", "versionStartIncluding": "9.3.2411"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BB42067-4A68-44D8-856A-2CC247C440E8", "versionEndExcluding": "10.0.2503.6", "versionStartIncluding": "10.0.2503"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "93DAD528-22AD-49F4-93AB-5E1AB5D7002B", "versionEndExcluding": "10.1.2507.4", "versionStartIncluding": "10.1.2507"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}