Splunk Enterprise Flaws Allow Attackers to Run Unauthorized JavaScript Code

Splunk released security advisories addressing multiple vulnerabilities affecting various versions of Splunk Enterprise and Splunk Cloud Platform, ranging from cross-site scripting to access control bypasses with CVSS scores from 4.6 to 7.5. The disclosures identify six distinct flaws primarily impacting Splunk Web components, including two low-privilege cross-site scripting issues that could let attackers run malicious JavaScript in victims’ browsers.

The identified CVEs include CVE-2025-20366, CVE-2025-20367, CVE-2025-20368, CVE-2025-20369, CVE-2025-20370 and CVE-2025-20371, with severities spanning medium to high, the latter representing an unauthenticated blind server-side request forgery attack scoring 7.5.

Affected products include Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform builds below certain thresholds, while Splunk Enterprise 10.0.0 remains vulnerable to LDAP DoS and SSRF but not to the XSS or access‑control issues. Organisations are urged to upgrade to the patched releases 10.0.1, 9.4.4, 9.3.6 or 9.2.8, and to apply workarounds such as disabling Splunk Web or adjusting web.conf and user role privileges where patching isn’t feasible.

The vulnerabilities primarily target the Splunk Web surface, with SSRF affecting the REST API, and mitigations emphasise reinforced access controls and monitoring of unusual search job activity.