CVE-2025-20385: XSS in Splunk Enterprise

This XSS vulnerability allows a malicious user with the adminallobjects role to inject arbitrary JavaScript code into the Splunk Enterprise interface. This code will then execute in the context of other users' browsers when they navigate to the affected collection. An attacker could leverage this to steal session cookies, redirect users to phishing sites, or deface the Splunk interface. The impact is particularly concerning given the high privileges associated with the adminallobjects role, potentially granting an attacker access to sensitive data and control over the Splunk environment. Successful exploitation could lead to unauthorized data access and modification, impacting the integrity and confidentiality of Splunk data.

1. Reserved2024-10-10
2. Published2025-12-03
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-20385 is to upgrade Splunk Enterprise to version 10.1.2507.6 or later, or Splunk Cloud Platform to version 10.1.2507.6, 10.0.2503.7, or 9.3.2411.117. If immediate upgrade is not possible, consider restricting the adminallobjects role to only trusted users. While a direct WAF rule is difficult to implement due to the nature of XSS, carefully review and restrict allowed HTML tags and attributes within collection names and descriptions. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload within a collection's navigation bar and verifying that it does not execute.