Threats Tagged 'cve-2025-20388'

CVE-2025-20388 is a low-severity vulnerability in Splunk Enterprise and Splunk Cloud Platform versions prior to specified patched releases. It allows users with the high-privilege capability 'change_authentication' to enumerate internal IP addresses and network ports by adding new search peers in a distributed Splunk environment. The vulnerability arises because the web server does not sufficiently verify that URL requests from upstream components target expected destinations. Exploitation requires authenticated access with elevated privileges but does not require user interaction. Although the confidentiality impact is limited to internal network information disclosure, this could aid attackers in further reconnaissance. No known exploits are reported in the wild. European organizations using affected Splunk versions in distributed deployments should prioritize patching and restrict high-privilege roles to trusted administrators. Countries with significant Splunk Enterprise adoption and critical infrastructure monitoring, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.

LowVulnerabilityGermanyFranceNetherlands+4#cve#cve-2025-20388