Splunk Enterprise/Enterprise Cloud path traversal

Summaryinfo

A vulnerability identified as problematic has been detected in Splunk Enterprise and Enterprise Cloud. Affected by this vulnerability is an unknown functionality. This manipulation causes path traversal. This vulnerability is registered as CVE-2025-20320. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Splunk Enterprise and Enterprise Cloud (affected version not known). It has been declared as problematic. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-35. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. As an impact it is known to affect integrity, and availability. The summary by CVE is:

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.

The advisory is shared at advisory.splunk.com. This vulnerability is known as CVE-2025-20320 since 10/10/2024. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-20303). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Enterprise
• Enterprise Cloud

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion