VYPR
← All advisories
Low severity3.1NVD Advisory· Published Nov 12, 2025· Updated Jun 17, 2026

CVE-2025-20378

CVE-2025-20378

Description

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the return_to parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious URL, it could cause an unvalidated redirect to an external malicious site. To be successful, the attacker has to trick the victim into initiating a request from their browser. The unauthenticated attacker should not be able to exploit the vulnerability at will.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Splunk/Splunk Enterprisellm-fuzzy2 versions
    <10.0.1, <9.4.5, <9.3.7, <9.2.9+ 1 more
    • (no CPE)range: <10.0.1, <9.4.5, <9.3.7, <9.2.9
    • (no CPE)range: 10.0
  • Splunk/Splunk Cloud Platformllm-fuzzy3 versions
    <10.0.2503.5, <9.3.2411.111, <9.3.2408.121+ 2 more
    • (no CPE)range: <10.0.2503.5, <9.3.2411.111, <9.3.2408.121
    • (no CPE)range: 10.0.2503
    • cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*range: >=9.3.2408,<9.3.2408.121
  • Splunk/Splunk2 versions
    cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*+ 1 more
    • cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*range: >=9.2.0,<9.2.9
    • cpe:2.3:a:splunk:splunk:10.0.0:*:*:*:enterprise:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.