Access Control Flaw in Splunk Enterprise and Secure Gateway App
CVE-2025-20230

4.3MEDIUM

Key Information:

Vendor

Splunk
Status
Splunk Enterprise
Splunk Secure Gateway
Vendor
CVE Published:
26 March 2025

What is CVE-2025-20230?

In specific versions of Splunk Enterprise and the Splunk Secure Gateway app, a vulnerability exists that allows low-privileged users to edit and delete data belonging to other users. The flaw arises from inadequate access control and improper data ownership management within KVStore collections, which results in data being owned by the generic 'nobody' user. This oversight places sensitive user data at risk by allowing unauthorized access and manipulation, undermining the integrity of the application.

Affected Version(s)

Splunk Enterprise 9.4 < 9.4.1

Splunk Enterprise 9.3 < 9.3.3

Splunk Enterprise 9.2 < 9.2.5

References

https://advisory.splunk.com/advisories/SVD-2025-0307

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gabriel Nitu, Splunk<br><br>David Chen, Splunk
.