Open Redirect on Web Login endpoint in Splunk Enterprise

Advisory ID: SVD-2025-1101

CVE ID: CVE-2025-20378

Published: 2025-11-12

Last Update: 2025-11-12

CVSSv3.1 Score: 3.1, Low

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE: CWE-601

Bug ID: VULN-22316

Description

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the return_to parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious URL, it could cause an unvalidated redirect to an external malicious site.

To be successful, the attacker has to trick the victim into initiating a request from their browser. The unauthenticated attacker should not be able to exploit the vulnerability at will.

Solution

Upgrade Splunk Enterprise to versions 10.0.1, 9.4.5, 9.3.7, 9.2.9, or higher.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

ProductBase VersionComponentAffected VersionFix Version
Splunk Enterprise10.0Splunk Web10.0.010.0.1
Splunk Enterprise9.4Splunk Web9.4.0 to 9.4.49.4.5
Splunk Enterprise9.3Splunk Web9.3.0 to 9.3.69.3.7
Splunk Enterprise9.2Splunk Web9.2.0 to 9.2.89.2.9
Splunk Cloud Platform10.0.2503Splunk WebBelow 10.0.2503.510.0.2503.5
Splunk Cloud Platform9.3.2411Splunk WebBelow 9.3.2411.1119.3.2411.111
Splunk Cloud Platform9.3.2408Splunk WebBelow 9.3.2408.1219.3.2408.121

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web enabled, turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on disabling Splunk Web.

Detections

None

Severity

Splunk rates this vulnerability a 3.1, Low, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.

Acknowledgments

Diogo Real (c0rte)