Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise
Advisory ID: SVD-2025-1204
CVE ID: CVE-2025-20385
Published: 2025-12-03
Last Update: 2025-12-03
CVSSv3.1 Score: 2.4, Low
CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
CWE: CWE-79
Bug ID: VULN-43277
Description
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability admin_all_objects could craft a malicious payload through the href attribute of an anchor tag within a collection in the navigation bar, which could result in execution of unauthorized JavaScript code in the browser of a user.
See Define roles on the Splunk platform with capabilities and https://dev.splunk.com/enterprise/docs/developapps/createapps/addnavsplunkapp/
Solution
Upgrade Splunk Enterprise to versions 10.0.2, 9.4.6, 9.3.8, 9.2.10, or higher.
Splunk is actively monitoring and patching Splunk Cloud Platform instances.
Product Status
| Product | Base Version | Component | Affected Version | Fix Version |
|---|---|---|---|---|
| Splunk Enterprise | 10.0 | Splunk Web | Below 10.0.2 | 10.0.2 |
| Splunk Enterprise | 9.4 | Splunk Web | 9.4.0 to 9.4.5 | 9.4.6 |
| Splunk Enterprise | 9.3 | Splunk Web | 9.3.0 to 9.3.7 | 9.3.8 |
| Splunk Enterprise | 9.2 | Splunk Web | 9.2.0 to 9.2.9 | 9.2.10 |
| Splunk Cloud Platform | 10.1.2507 | Splunk Web | Below 10.1.2507.6 | 10.1.2507.6 |
| Splunk Cloud Platform | 10.0.2503 | Splunk Web | Below 10.0.2503.7 | 10.0.2503.7 |
| Splunk Cloud Platform | 9.3.2411 | Splunk Web | Below 9.3.2411.117 | 9.3.2411.117 |
Mitigations and Workarounds
The vulnerability affects instances with Splunk Web enabled, turning Splunk Web off is a possible workaround. See Disable unnecessary Splunk Enterprise components and the web.conf configuration specification file for more information on disabling Splunk Web.
Detections
None
Severity
Splunk rates this vulnerability a 2.4, Low, with a CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N.
Acknowledgments
Dr. Oliver Matula, DB Systel GmbH