{"id":"CVE-2025-20320","aliases":["EUVD-2025-20303","GHSA-f5m7-22fg-43fw"],"status":"published","title":"Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise","description":"In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00462,"percentile":0.40282,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-35"],"published":"2025-07-07T17:47:59Z","modified":"2026-06-17T08:41:27Z","products":[{"vendor":"splunk","product":"splunk"},{"vendor":"splunk","product":"splunk enterprise"},{"vendor":"splunk","product":"splunk enterprise cloud"},{"vendor":"splunk","product":"splunk_cloud_platform"}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2025-0703","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-20320"},{"url":"https://github.com/advisories/GHSA-f5m7-22fg-43fw"}],"sources":{"cve":[{"id":"CVE-2025-20320","title":"Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk Enterprise","description":"In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.","status":"published","published":"2025-07-07T17:47:59.569Z","modified":"2025-07-08T13:37:17.043Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-35"],"updated_at":"2026-11-02T14:32:25.982948Z"}],"euvd":[{"id":"EUVD-2025-20303","description":"In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.","status":"published","published":"2025-07-07T17:47:59Z","modified":"2025-07-08T13:37:17Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:13.001759Z"}],"ghsa":[{"id":"GHSA-f5m7-22fg-43fw","title":"In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform...","description":"In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.","status":"published","published":"2025-07-07T18:32:28Z","modified":"2025-07-07T18:32:34Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-35"],"updated_at":"2026-11-02T15:02:55.508924Z"}],"nvd":[{"id":"CVE-2025-20320","description":"In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a malicious payload through the `User Interface - Views` configuration page that could potentially lead to a denial of service (DoS).The user could cause the DoS by exploiting a path traversal vulnerability that allows for deletion of arbitrary files within a Splunk directory. The vulnerability requires the low-privileged user to phish the administrator-level victim by tricking them into initiating a request within their browser. The low-privileged user should not be able to exploit the vulnerability at will.","status":"published","published":"2025-07-07T18:15:25.987Z","modified":"2026-06-17T08:41:27.287Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-35"],"updated_at":"2026-11-02T14:11:16.997062Z"}]}}