Splunk Fixes Six Flaws, Including Unauthenticated SSRF and XSS Vulnerabilities in Enterprise Platform

Splunk has issued advisories for six vulnerabilities in its Enterprise and Cloud platforms, spanning improper access control, several XSS flaws, XXE injection, and DoS risks through LDAP misuse, with the most severe being an unauthenticated blind SSRF.

The flaws include CVE-2025-20366 (CVSS 6.5) in background job submission, where a low-privileged user could access sensitive search results by guessing a SID; CVE-2025-20367 (CVSS 5.7) a reflected XSS via the /app/search/table endpoint; CVE-2025-20368 (CVSS 5.7) storeXSS in saved searches; CVE-2025-20369 (CVSS 4.6) XXE in the dashboard tab label field; CVE-2025-20370 (CVSS 4.9) DoS via multiple LDAP bind requests; and CVE-2025-20371 (CVSS 7.5) an unauthenticated blind SSRF.

Fixes include upgrading to Splunk Enterprise 9.4.4, 9.3.6, or 9.2.8, or applying latest Cloud patches, with the DoS and SSRF advisories suggesting additional mitigations such as enabling or disabling certain web client settings, for example turning off enableSplunkWebClientNetloc. The advisories emphasise that customers should update promptly, as the blind SSRF could enable privilege abuse and lateral movement.

According to Splunk, the range of flaws highlights the importance of applying the latest patches across both on‑premises and cloud deployments. The article was published on 2 October 2025.