{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-29T20:27:18.977","vulnerabilities":[{"cve":{"id":"CVE-2025-20371","sourceIdentifier":"psirt@cisco.com","published":"2025-10-01T17:15:40.450","lastModified":"2025-10-08T20:25:35.023","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In Splunk Enterprise versions below 10.0.1, 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, an unauthenticated attacker could trigger a blind server-side request forgery (SSRF) potentially letting an attacker perform REST API calls on behalf of an authenticated high-privileged user."}],"metrics":{"cvssMetricV31":[{"source":"psirt@cisco.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"psirt@cisco.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.2.0","versionEndExcluding":"9.2.8","matchCriteriaId":"724443E6-2DC9-4AB3-8E8F-D9BFBCC162E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.3.0","versionEndExcluding":"9.3.6","matchCriteriaId":"046659D8-1F48-4229-AC57-2A3B77D44442"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"9.4.0","versionEndExcluding":"9.4.4","matchCriteriaId":"88D2F283-10F9-4204-876A-9BEE75130E2C"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk:10.0.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"259A3F4B-E4D2-48BC-9AE9-C37DE94987D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"9.2.2406","versionEndExcluding":"9.2.2406.122","matchCriteriaId":"DAA1E6F9-415D-4062-BC4E-4EDFA6F6A7CA"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"9.3.2408","versionEndExcluding":"9.3.2408.119","matchCriteriaId":"9BEB41CF-1F71-45BB-A434-984C16A2E174"},{"vulnerable":true,"criteria":"cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*","versionStartIncluding":"9.3.2411","versionEndExcluding":"9.3.2411.109","matchCriteriaId":"A5075451-6D11-4EA8-9BB5-9BB27ECF8A40"}]}]}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2025-1006","source":"psirt@cisco.com","tags":["Vendor Advisory"]}]}}]}