CVE-2025-20367
Reported by cisco · Published October 1, 2025
In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload through the `dataset.command` parameter of the `/app/search/table` endpoint, which could result in execution of unauthorized JavaScript code in the browser of a user.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| splunk | splunk | 9.4.4, 9.3.6, 9.2.8 |
| splunk_cloud_platform | splunk | 9.3.2411.109, 9.3.2408.119, 9.2.2406.122 |
| Splunk Cloud Platform | Splunk | 9.3.2411.109, 9.3.2408.119, 9.2.2406.122 |
| Splunk Enterprise | Splunk | 10.0.0, 9.4.4, 9.3.6, 9.2.8 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 10.0, 9.4, 9.3 |
| Splunk | Splunk Cloud Platform | 9.3.2411, 9.3.2408, 9.2.2406 |
| Splunk | Splunk Cloud Platform | 9.3.2411, 9.3.2408, 9.2.2406 |
| Splunk | Splunk Enterprise | 10.0, 9.3, 9.4 |
Timeline
- Oct 1, 2025 CVE Published
- Oct 2, 2025 EPSS Score (30 in total, the first dated here)
- Oct 2, 2025 Coalition ESS Score (7 in total, the first dated here)
- May 11, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-20367
vulnetix vdb fixes CVE-2025-20367Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-20367/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart