CNNVD-202510-037 Information
CNNVD ID
CNNVD-202510-037
Related CVE
- CNNVD Published: 2025-10-01
Description (Chinese)
Splunk Cloud Platform和Splunk Enterprise都是美国Splunk公司的产品。Splunk Cloud Platform是一个强大的数据收集、处理和分析服务。Splunk Enterprise是一套数据收集分析软件。 Splunk Cloud Platform和Splunk Enterprise存在代码问题漏洞，该漏洞源于未经验证的攻击者可触发盲服务端请求伪造，可能导致攻击者以高权限用户身份执行REST API调用。以下版本受到影响：Splunk Enterprise 10.0.1之前版本、9.4.4版本、9.3.6版本和9.2.8版本以及Splunk Cloud Platform 9.3.2411.109之前版本、9.3.2408.119之前版本和9.2.2406.122之前版本。
Description (English)
Splunk Cloud Platform and Splunk Enterprise are products of the United States company Splunk. Splung Cloud Platform is a powerful data collection, processing and analysis service. Splung Enterprise is a data collection and analysis software. Splung Cloud Platform and Splunk Enterprise had a code loophole, which stemmed from the fact that uncertified assailants could trigger a blind service request for forgery and could result in the attackers carrying out REST API calls as high-authorized users. The following versions were affected: the previous version of Splunk Enterprise 10.0.1, version 9.4.4, version 9.3.6 and version 9.2.8, and the former version of Splunk Cloud Platform 9.3.2411.109, the former version of 9.3.2408.119 and the previous version of 9.2.2406.122.
Hazard Level
Medium
Vulnerability Type
代码问题
Affected Vendor
Splunk
Published
2025-10-01
Last Modified
2026-02-24
References
https://advisory.splunk.com/advisories/SVD-2025-1006 https://vigilance.fr/vulnerability/Splunk-Enterprise-Server-Side-Request-Forgery-via-enableSplunkWebClientNetloc-48368
Patch
https://advisory.splunk.com/advisories/SVD-2025-1005
Share on: