5.7

CVE-2025-20231

Medienbericht

Sensitive Information Disclosure in Splunk Secure Gateway App

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search using the permissions of a higher-privileged user that could lead to disclosure of sensitive information.<br><br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated low-privileged user should not be able to exploit the vulnerability at will.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Splunk ≫ Splunk SwEdition enterprise Version >= 9.1.0 < 9.1.8
Splunk ≫ Splunk SwEdition enterprise Version >= 9.2.0 < 9.2.5
Splunk ≫ Splunk SwEdition enterprise Version >= 9.3.0 < 9.3.3
Splunk ≫ Splunk Version 9.4.0 SwEdition enterprise
Splunk ≫ Splunk Secure Gateway Version >= 3.7.0 < 3.7.23
Splunk ≫ Splunk Secure Gateway Version >= 3.8.0 < 3.8.38
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.395
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.7 2.1 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Cisco PSIRT 7.1 1.2 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
09.08.2025 11:36
https://advisory.splunk.com/advisories/SVD-2025-0302
Vendor Advisory