4.3

CVE-2025-20383

Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Splunk ≫ Splunk SwEdition enterprise Version >= 9.2.0 < 9.2.10
Splunk ≫ Splunk SwEdition enterprise Version >= 9.3.0 < 9.3.8
Splunk ≫ Splunk SwEdition enterprise Version >= 9.4.0 < 9.4.6
Splunk ≫ Splunk SwEdition enterprise Version >= 10.0.0 < 10.0.2
Splunk ≫ Splunk Cloud Platform Version >= 9.3.2411 < 9.3.2411.120
Splunk ≫ Splunk Cloud Platform Version >= 10.0.2503 < 10.0.2503.8
Splunk ≫ Splunk Cloud Platform Version >= 10.1.2507 < 10.1.2507.6
Splunk ≫ Splunk Secure Gateway Version >= 3.7.0 < 3.7.28
Splunk ≫ Splunk Secure Gateway Version >= 3.8.0 < 3.8.58
Splunk ≫ Splunk Secure Gateway Version >= 3.9.0 < 3.9.10
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.3% 0.219
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cisco PSIRT 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://advisory.splunk.com/advisories/SVD-2025-1202
Vendor Advisory