Splunk Enterprise/Cloud Platform HTTP Request /en-US/static/ neutralization for logs

Summaryinfo

A vulnerability has been found in Splunk Enterprise and Cloud Platform and classified as problematic. This impacts an unknown function of the file /en-US/static/ of the component HTTP Request Handler. The manipulation leads to neutralization for logs. This vulnerability is documented as CVE-2025-20384. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Splunk Enterprise and Cloud Platform (the affected version unknown) and classified as problematic. This issue affects an unknown part of the file /en-US/static/ of the component HTTP Request Handler. The manipulation with an unknown input leads to a neutralization for logs vulnerability. Using CWE to declare the problem leads to CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs. Impacted is integrity. The summary by CVE is:

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes into Splunk log files due to improper validation at the /en-US/static/ web endpoint. This may allow them to poison, forge, or obfuscate sensitive log data through specially crafted HTTP requests, potentially impacting log integrity and detection capabilities.

It is possible to read the advisory at advisory.splunk.com. The identification of this vulnerability is CVE-2025-20384 since 10/10/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 277115 (Splunk Enterprise 9.2.0 < 9.2.10, 9.3.0 < 9.3.8, 9.4.0 < 9.4.6, 10.0 < 10.0.1 (SVD-2025-1203)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (277115). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Cloud Platform
• Enterprise

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion