CVE-2025-20231

Published Mar 26, 2025

Last updated 9 months ago

CVSS high 7.1

Splunk

Overview

Description: In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search using the permissions of a higher-privileged user that could lead to disclosure of sensitive information.<br><br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated low-privileged user should not be able to exploit the vulnerability at will.
Source: psirt@cisco.com
NVD status: Analyzed
Products: splunk, splunk_secure_gateway

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.7
Impact score: 3.6
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

psirt@cisco.com: CWE-532

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "49EE75F0-2AD6-4712-9E2A-C000A44E5605",
            "versionEndExcluding": "9.1.8",
            "versionStartIncluding": "9.1.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "5B7E20B1-E38E-4F5E-9F89-41FD4C231742",
            "versionEndExcluding": "9.2.5",
            "versionStartIncluding": "9.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "E66E66BA-AFC2-4E0A-B233-9E2C7D985AF0",
            "versionEndExcluding": "9.3.3",
            "versionStartIncluding": "9.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk:9.4.0:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "AD39F156-52DB-4F43-8528-37500E3AEB89",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3B85AEDE-7363-42D5-8F3C-1865BB39166C",
            "versionEndExcluding": "3.7.23",
            "versionStartIncluding": "3.7.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6DD62957-0C8B-49FC-BC63-2E0CDC041021",
            "versionEndExcluding": "3.8.38",
            "versionStartIncluding": "3.8.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References