CVE-2025-20367: In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a…

PriorityP430medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.34%

25.3th percentile

In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload through the `dataset.command` parameter of the `/app/search/table` endpoint, which could result in execution of unauthorized JavaScript code in the browser of a user.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
splunk	splunk	>= 9.2.0 < 9.2.8	9.2.8
splunk	splunk	>= 9.3.0 < 9.3.6	9.3.6
splunk	splunk	>= 9.4.0 < 9.4.4	9.4.4
splunk	splunk_cloud_platform	>= 9.2.2406 < 9.2.2406.122	9.2.2406.122
splunk	splunk_cloud_platform	>= 9.3.2408 < 9.3.2408.119	9.3.2408.119
splunk	splunk_cloud_platform	>= 9.3.2411 < 9.3.2411.109	9.3.2411.109
splunk	splunk_enterprise	>= 10.0 < 10.0.0	10.0.0
splunk	splunk_enterprise	>= 9.2 < 9.2.8	9.2.8
splunk	splunk_enterprise	>= 9.3 < 9.3.6	9.3.6
splunk	splunk_enterprise	>= 9.4 < 9.4.4	9.4.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.