Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise
Advisory ID: SVD-2025-0703
CVE ID: CVE-2025-20320
Published: 2025-07-07
Last Update: 2025-07-07
CVSSv3.1 Score: 6.3, Medium
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
CWE: CWE-35
Bug ID: VULN-31600
Description
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could craft a malicious payload through the User Interface - Views configuration page that could potentially lead to a denial of service (DoS).
The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory.
The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.
Solution
Upgrade Splunk Enterprise to versions 9.4.3, 9.3.5, 9.2.7, 9.1.10, or higher.
Splunk is actively monitoring and patching Splunk Cloud Platform instances.
Product Status
| Product | Base Version | Component | Affected Version | Fix Version |
|---|---|---|---|---|
| Splunk Enterprise | 9.4 | Splunk Web | 9.4.0 to 9.4.2 | 9.4.3 |
| Splunk Enterprise | 9.3 | Splunk Web | 9.3.0 to 9.3.4 | 9.3.5 |
| Splunk Enterprise | 9.2 | Splunk Web | 9.2.0 to 9.2.6 | 9.2.7 |
| Splunk Enterprise | 9.1 | Splunk Web | 9.1.0 to 9.1.9 | 9.1.10 |
| Splunk Enterprise Cloud | 9.3.2411 | Splunk Web | Below 9.3.2411.107 | 9.3.2411.107 |
| Splunk Enterprise Cloud | 9.3.2408 | Splunk Web | Below 9.3.2408.117 | 9.3.2408.117 |
| Splunk Enterprise Cloud | 9.2.2406 | Splunk Web | Below 9.2.2406.121 | 9.2.2406.121 |
Mitigations and Workarounds
The vulnerability affects instances with Splunk Web turned on. You could turn Splunk Web off as a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on turning Splunk Web off.
Detections
None
Severity
Splunk rates this vulnerability a 6.3, Medium, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H.
Acknowledgments
Danylo Dmytriiev (DDV_UA)