Plain Text Exposure of Secrets in Splunk Add-on for Palo Alto Networks

CVE-2025-20373

What is CVE-2025-20373?

The Splunk Add-on for Palo Alto Networks prior to version 2.0.2 has a significant vulnerability where client secrets are exposed in plain text within the _internal index during the addition of new Data Security Accounts. This exposure necessitates either direct access to log files or administrative access to internal indexes—permissions typically reserved for users in the admin role. For enhanced security, it is crucial to review and restrict access to the internal index, ensuring that only administrator-level roles have the ability to view sensitive data. For more information, please refer to the Splunk guidance on managing roles and capabilities.

References