Listen to this Post
How the CVE Works
CVE-2025-20320 is a path traversal vulnerability in Splunk Enterprise and Splunk Cloud Platform, affecting versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10 (Enterprise) and below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121 (Cloud). A low-privileged user without “admin” or “power” roles can craft a malicious payload via the `User Interface – Views` configuration page. This payload exploits improper input sanitization, allowing traversal outside intended directories. The attacker must trick an admin into initiating a request (e.g., via phishing), leading to arbitrary file deletion within Splunk directories, causing DoS. The exploit is not self-executable and relies on social engineering.
DailyCVE Form
Platform: Splunk Enterprise/Cloud
Version: <9.4.3, <9.3.5, <9.2.7, <9.1.10
Vulnerability: Path Traversal
Severity: Low
Date: 07/07/2025
Prediction: Patch by 08/15/2025
What Undercode Say
Check Splunk version splunk version Verify vulnerable configs grep -r "ui_views" /opt/splunk/etc/ Log analysis for exploitation attempts tail -f /opt/splunk/var/log/splunk/web_service.log | grep "malicious_payload"
How Exploit
1. Attacker crafts malicious payload via UI Views.
2. Phishes admin to trigger request.
3. Payload traverses paths, deletes critical files.
Protection from this CVE
- Update to patched versions.
- Restrict UI Views access.
- Educate admins on phishing risks.
Impact
- DoS via file deletion.
- Requires admin interaction.
- Low-privilege exploitation.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
