Access Control Flaw in Splunk Enterprise and Secure Gateway App
CVE-2025-20230

6.5MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Splunk Secure Gateway
Vendor
CVE Published:
26 March 2025

What is CVE-2025-20230?

In specific versions of Splunk Enterprise and the Splunk Secure Gateway app, a vulnerability exists that allows low-privileged users to edit and delete data belonging to other users. The flaw arises from inadequate access control and improper data ownership management within KVStore collections, which results in data being owned by the generic 'nobody' user. This oversight places sensitive user data at risk by allowing unauthorized access and manipulation, undermining the integrity of the application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Splunk Enterprise 9.4 < 9.4.1

Splunk Enterprise 9.3 < 9.3.3

Splunk Enterprise 9.2 < 9.2.5

References

https://advisory.splunk.com/advisories/SVD-2025-0307

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Nitu, Splunk<br><br>David Chen, Splunk
JSON
.