Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-20321— Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

CVSS 6.5 · Medium EPSS 0.07% · P21
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-20321

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise
Source: NVD (National Vulnerability Database)
Vulnerability Description
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster (SHC) through a Cross-Site Request Forgery (CSRF), potentially leading to the removal of the captain or a member of the SHC.<br><br>The vulnerability requires the attacker to phish the administrator-level victim by tricking them into initiating a request within their browser. The attacker should not be able to exploit the vulnerability at will.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨站请求伪造(CSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Splunk Cloud Platform和Splunk Enterprise 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Splunk Cloud Platform和Splunk Enterprise都是美国Splunk公司的产品。Splunk Cloud Platform是一个强大的数据收集、处理和分析服务。Splunk Enterprise是一套数据收集分析软件。 Splunk Enterprise和Splunk Cloud Platform存在跨站请求伪造漏洞，该漏洞源于跨站请求伪造，可能导致搜索头集群成员状态变更。以下产品及版本受到影响:Splunk Enterprise 9.4.3、9.3.5、9.2.7和9.1.
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SplunkSplunk Enterprise 9.4 ~ 9.4.3 -
SplunkSplunk Enterprise Cloud 9.3.2411 ~ 9.3.2411.104 -

II. Public POCs for CVE-2025-20321

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-20321

请登录查看更多情报信息。

Same Patch Batch · Splunk · 2025-07-07 · 8 CVEs total

CVE-2025-203196.8 MEDIUMRemote Command Execution through Scripted Input Files in Splunk Enterprise
CVE-2025-203206.3 MEDIUMDenial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Ente
CVE-2025-203245.4 MEDIUMImproper Access Control in System Source Types Configuration in Splunk Enterprise
CVE-2025-203224.3 MEDIUMDenial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) i
CVE-2025-203234.3 MEDIUMMissing Access Control of Saved Searches in the Splunk Archiver app
CVE-2025-203004.3 MEDIUMImproper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk Enter
CVE-2025-203253.1 LOWSensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments

IV. Related Vulnerabilities

Same product: Splunk Enterprise
Same vendor: Splunk
Same weakness: CWE-352

V. Comments for CVE-2025-20321

No comments yet

Leave a comment