4.3

CVE-2025-20383

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Splunk ≫ Splunk SwEditionenterprise Version >= 9.2.0 < 9.2.10
Splunk ≫ Splunk SwEditionenterprise Version >= 9.3.0 < 9.3.8
Splunk ≫ Splunk SwEditionenterprise Version >= 9.4.0 < 9.4.6
Splunk ≫ Splunk SwEditionenterprise Version >= 10.0.0 < 10.0.2
Splunk ≫ Splunk Cloud Platform Version >= 9.3.2411 < 9.3.2411.120
Splunk ≫ Splunk Cloud Platform Version >= 10.0.2503 < 10.0.2503.8
Splunk ≫ Splunk Cloud Platform Version >= 10.1.2507 < 10.1.2507.6
Splunk ≫ Splunk Secure Gateway Version >= 3.7.0 < 3.7.28
Splunk ≫ Splunk Secure Gateway Version >= 3.8.0 < 3.8.58
Splunk ≫ Splunk Secure Gateway Version >= 3.9.0 < 3.9.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.088
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@cisco.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.