Unauthorized Code Execution in Splunk Enterprise and Cloud Platform
CVE-2025-20297

4.3MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Splunk Cloud Platform
Vendor
CVE Published:
2 June 2025

What is CVE-2025-20297?

In certain versions of Splunk Enterprise and Cloud Platform, a low-privileged user could exploit the pdfgen/render REST endpoint to craft a malicious payload. This payload may enable the execution of unauthorized JavaScript code in a user's browser, potentially compromising sensitive information and security integrity. This vulnerability underscores the necessity for stringent access controls and user role management.

Affected Version(s)

Splunk Cloud Platform 9.3.2411 < 9.3.2411.102

Splunk Cloud Platform 9.3.2408 < 9.3.2408.111

Splunk Cloud Platform 9.2.2406 < 9.2.2406.118

References

https://advisory.splunk.com/advisories/SVD-2025-0601

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Klevis Luli, Splunk
.