Unauthorized Information Disclosure in Splunk Enterprise by Low-Privileged Users

CVE-2025-20231

Summary

In specific versions of Splunk Enterprise and the Splunk Secure Gateway app on Splunk Cloud Platform, low-privileged users can exploit a vulnerability that allows them to run searches under the permissions of higher-privileged users. This can potentially lead to the unauthorized disclosure of sensitive information. The attack relies on phishing, where the low-privileged user tricks a victim into executing a request through their browser. Consequently, this vulnerability poses a risk of exposing critical information without requiring elevated privileges directly.

References