URL validation bypass through Views Dashboard in Splunk Enterprise

Advisory ID: SVD-2025-1201

CVE ID: CVE-2025-20382

Published: 2025-12-03

Last Update: 2025-12-03

CVSSv3.1 Score: 3.5, Low

CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE: CWE-601

Bug ID: VULN-20632

Description

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a low-privileged user that does not hold the “admin” or “power” Splunk roles could create a views dashboard with a custom background using the data:image/png;base64 protocol that could potentially lead to an unvalidated redirect. This behavior circumvents the Splunk external URL warning mechanism by using a specially crafted URL, allowing for a redirection to an external malicious site. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated user should not be able to exploit the vulnerability at will.

Solution

Upgrade Splunk Enterprise to versions 10.0.2, 9.4.6, 9.3.8, 9.2.10, or higher.

Splunk is actively monitoring and patching Splunk Cloud Platform instances.

Product Status

ProductBase VersionComponentAffected VersionFix Version
Splunk Enterprise10.0Splunk WebBelow 10.0.210.0.2
Splunk Enterprise9.4Splunk Web9.4.0 to 9.4.59.4.6
Splunk Enterprise9.3Splunk Web9.3.0 to 9.3.79.3.8
Splunk Enterprise9.2Splunk Web9.2.0 to 9.2.99.2.10
Splunk Cloud Platform10.1.2507Splunk WebBelow 10.1.2507.1010.1.2507.10
Splunk Cloud Platform10.0.2503Splunk WebBelow 10.0.2503.810.0.2503.8
Splunk Cloud Platform9.3.2411Splunk WebBelow 9.3.2411.1209.3.2411.120

Mitigations and Workarounds

The vulnerability affects instances with Splunk Web enabled, turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on disabling Splunk Web.

Detections

None

Severity

Splunk rates this vulnerability a 3.5, Low, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N.

Acknowledgments

Anton (therceman)