CVE-2025-20384

🗓️ 03 Dec 2025 17:00:34Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

Unauthenticated log injection via /en-US/static/ endpoint poisons logs in Splunk Enterprise.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-20384	4 Dec 202514:50	–	circl
CNNVD	Splunk Cloud Platform和Splunk Enterprise 安全漏洞	3 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-20384 Unauthenticated Log Injection in Splunk Enterprise	3 Dec 202517:00	–	cvelist
GithubExploit	Exploit for Improper Output Neutralization for Logs in Splunk	7 Dec 202514:36	–	githubexploit
EUVD	EUVD-2025-201004	3 Dec 202517:00	–	euvd
NCSC	Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform	8 Dec 202508:23	–	ncsc
NVD	CVE-2025-20384	3 Dec 202517:15	–	nvd
OSV	CVE-2025-20384	3 Dec 202517:15	–	osv
Positive Technologies	PT-2025-48956	3 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-20384	4 Dec 202517:16	–	redhatcve

NVD

Node

splunk splunkRange9.2.0–9.2.10enterprise

splunk splunkRange9.3.0–9.3.8enterprise

splunk splunkRange9.4.0–9.4.6enterprise

splunk splunkMatch10.0.0enterprise

splunk splunk_cloud_platformRange9.3.2411–9.3.2411.117

splunk splunk_cloud_platformRange10.0.2503–10.0.2503.6

splunk splunk_cloud_platformRange10.1.2507–10.1.2507.4

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "10.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.0.1"
      },
      {
        "version": "9.4",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.4.6"
      },
      {
        "version": "9.3",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.3.8"
      },
      {
        "version": "9.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.2.10"
      }
    ]
  },
  {
    "product": "Splunk Cloud Platform",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "10.1.2507",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.1.2507.4"
      },
      {
        "version": "10.0.2503",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.0.2503.6"
      },
      {
        "version": "9.3.2411",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.3.2411.117"
      }
    ]
  }
]

Source	Link
advisory	www.advisory.splunk.com/advisories/SVD-2025-1203

Parameter	Position	Path	Description	CWE
check	query param	/en-US/static/	Possibility of log injection via ANSI escape code payloads in requests to the static endpoint, enabling log poisoning/forgery via improper validation.	CWE-117
check	query param	/en-US/app/SplunkEnterpriseSecuritySuite/apple-touch-icon.png	POC indicates crafting a request with a malformed or special parameter to trigger log injection at a path associated with static assets under the app, enabling log data obfuscation/poisoning.	CWE-117

17 Jun 2026 08:41Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.15.3

EPSS0.00339

SSVC

CWE-117