5.4Mittel
CVE-2025-20324Improper Access Control in System Source Types Configuration in Splunk Enterprise
Beschreibung
In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite [system source type](https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/9.2/configure-source-types/create-source-types) configurations by sending a specially-crafted payload to the `/servicesNS/nobody/search/admin/sourcetypes/` REST endpoint on the Splunk management port.
Schwachstellentyp (CWE):
CWE-284
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| splunk | splunk | 9.1.0 – < 9.1.10 | |
| splunk | splunk cloud platform | 9.2.2406 – < 9.2.2406.119 | |
| Splunk | Splunk Enterprise | 9.4 – < 9.4.2, 9.3 – < 9.3.5, 9.2 – < 9.2.7, 9.1 – < 9.1.10 | |
| Splunk | Splunk Enterprise Cloud | 9.3.2411 – < 9.3.2411.104, 9.3.2408 – < 9.3.2408.113, 9.2.2406 – < 9.2.2406.119 |
Referenzen und Patches
- https://advisory.splunk.com/advisories/SVD-2025-0707 Vendor Advisory
CPE-Treffer (NVD) (7)
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.1.0 < 9.1.10cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.2.0 < 9.2.7cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.3.0 < 9.3.5cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.4.0 < 9.4.2cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*≥ 9.2.2406 < 9.2.2406.119cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*≥ 9.3.2408 < 9.3.2408.113cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*≥ 9.3.2411 < 9.3.2411.104