VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jul 7, 2025· Updated Jun 17, 2026

CVE-2025-20324

CVE-2025-20324

Description

In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create or overwrite system source type configurations by sending a specially-crafted payload to the /servicesNS/nobody/search/admin/sourcetypes/ REST endpoint on the Splunk management port.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Splunk/Splunk Cloud Platformllm-fuzzy
    Range: <9.3.2411.104, <9.3.2408.113, <9.2.2406.119
  • Splunk/Splunk Enterprisellm-fuzzy3 versions
    <9.4.2, <9.3.5, <9.2.7, <9.1.10+ 2 more
    • (no CPE)range: <9.4.2, <9.3.5, <9.2.7, <9.1.10
    • (no CPE)range: 9.4
    • (no CPE)range: 9.3.2411

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.