« Volver al listado

CVE-2026-20252

Estado: AnalizadaAlta (7.6)—

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could send server-side requests to arbitrary internal destinations through the Dashboard Studio PDF export feature.

The vulnerability exists because the trusted-domain validation uses a prefix match that can be bypassed with attacker-controlled subdomains (for example, docs.splunk.com.evil.com), and because the PDF export service follows HTTP redirects automatically without re-validating each redirect target against the allowlist.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N PR:L sin UI indica acceso remoto con privilegios bajos; CWE-918 (SSRF) y bypass de validación de dominios con redirects permite solicitudes a destinos internos arbitrarios (SSRF/proxy). Riesgo potencial de exposición de datos internos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationNetwork Intrusion Prevention

Tecnologías afectadas (2)

Splunk — SplunkSplunk — Splunk Cloud Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-20252",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20252",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-10T18:23:29.592434Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "Splunk",
          "product": "Splunk Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "10.2",
              "lessThan": "10.2.4",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.0",
              "lessThan": "10.0.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.4",
              "lessThan": "9.4.12",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.3",
              "lessThan": "9.3.13",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Splunk",
          "product": "Splunk Cloud Platform",
          "versions": [
            {
              "status": "affected",
              "version": "10.4.2604",
              "lessThan": "10.4.2604.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.3.2512",
              "lessThan": "10.3.2512.12",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.2.2510",
              "lessThan": "10.2.2510.14",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.1.2507",
              "lessThan": "10.1.2507.22",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.3.2411",
              "lessThan": "9.3.2411.132",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-10T18:16:40.630",
  "references": [
    {
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0602",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could send server-side requests to arbitrary internal destinations through the Dashboard Studio PDF export feature.  \n\nThe vulnerability exists because the trusted-domain validation uses a prefix match that can be bypassed with attacker-controlled subdomains (for example, docs.splunk.com.evil.com), and because the PDF export service follows HTTP redirects automatically without re-validating each redirect target against the allowlist."
    }
  ],
  "lastModified": "2026-06-17T10:17:19.850",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9D80F1C-F849-4D62-B82A-6B8963EEEBFB",
              "versionEndExcluding": "9.3.13",
              "versionStartIncluding": "9.3.0"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "423B8DF2-B7A5-41AA-9CFD-75B2FD503ACC",
              "versionEndExcluding": "9.4.12",
              "versionStartIncluding": "9.4.0"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C9F1DED-280E-4C76-A867-A7A8FCBD1F7A",
              "versionEndExcluding": "10.0.7",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E3B992C0-AD5E-43A1-BAA3-6B11FFD5D750",
              "versionEndExcluding": "10.2.4",
              "versionStartIncluding": "10.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88A68C7C-BE2C-465C-812B-8F211A8AE935",
              "versionEndExcluding": "9.3.2411.132",
              "versionStartIncluding": "9.3.2411"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13BDF451-89BD-4E5B-8DCB-16BF9AE81FAC",
              "versionEndExcluding": "10.1.2507.22",
              "versionStartIncluding": "10.1.2507"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE580133-150E-4007-989F-00491BF7A064",
              "versionEndExcluding": "10.2.2510.14",
              "versionStartIncluding": "10.2.2510"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D78DAE10-4B29-4B44-B09A-041500E22CEF",
              "versionEndExcluding": "10.3.2512.12",
              "versionStartIncluding": "10.3.2512"
            },
            {
              "criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCF61DDA-755F-408D-93A8-86E35256E1E9",
              "versionEndExcluding": "10.4.2604.3",
              "versionStartIncluding": "10.4.2604"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}