Arbitrary Source Type Configuration Vulnerability in Splunk Enterprise and Cloud Platform
CVE-2025-20324

5.4MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Splunk Enterprise Cloud
Vendor
CVE Published:
7 July 2025

What is CVE-2025-20324?

In specific versions of Splunk Enterprise and Splunk Cloud Platform, a vulnerability permits low-privileged users to create or overwrite sensitive source type configurations via a crafted payload sent to a REST endpoint. This flaw compromises system integrity, allowing unauthorized modifications to critical data ingestion settings. Proper role-based access controls are essential to safeguard against this type of exploit.

Affected Version(s)

Splunk Enterprise 9.4 < 9.4.2

Splunk Enterprise 9.3 < 9.3.5

Splunk Enterprise 9.2 < 9.2.7

References

https://advisory.splunk.com/advisories/SVD-2025-0707

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.