Cross-Site Request Forgery Vulnerability in Splunk Enterprise and Cloud
CVE-2025-20228
6.5MEDIUM
Key Information:
- Vendor
Splunk
- Vendor
- CVE Published:
- 26 March 2025
What is CVE-2025-20228?
In certain versions of Splunk Enterprise and Splunk Cloud Platform, a low-privileged user, lacking 'admin' or 'power' roles, could manipulate the maintenance mode state of the App Key Value Store (KVStore). This vulnerability arises due to inadequate protections against Cross-Site Request Forgery (CSRF), potentially allowing unauthorized changes to critical system settings without sufficient privileges.
Affected Version(s)
Splunk Cloud Platform 9.2.2403 < 9.2.2403.108
Splunk Cloud Platform 9.1.2312 < 9.1.2312.204
Splunk Enterprise 9.3 < 9.3.3