Analysis Summary

CVE-2025-20297 CVSS:4.3

In Cisco Splunk Enterprise and Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the pdfgen/render REST endpoint that could result in the execution of unauthorized JavaScript code in the browser of a user.

CVE-2025-20298 CVSS:8

In Universal Forwarder for Windows, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwarder). This lets non-administrator users on the machine access the directory and all its contents.

Impact

• Code Execution
• Cross-Site Scripting

Indicators of Compromise

CVE

• CVE-2025-20297

• CVE-2025-20298

Affected Vendors

Remediation

Refer to the Cisco Splunk Security Advisory for patch, upgrade, or suggested workaround information.

CVE-2025-20297

CVE-2025-20298