Skip to content
OpenAdvisories
High NCSC-2025-0099 8 CVEs

Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

Published Mar 27, 2025 · Updated Mar 27, 2025 · nl

Vendor: Splunk Product: Cloud Platform Product: Enterprise Product: Secure Gateway Product: splunk

Summary

Splunk heeft kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

Details

Interpretaties
De kwetsbaarheden stellen laaggeprivilegieerde gebruikers in staat om hogere gebruikersrechten te misbruiken, wat kan leiden tot ongeautoriseerde acties en toegang tot gevoelige informatie. Dit kan gebeuren via phishing-aanvallen en Cross-Site Request Forgery (CSRF) aanvallen, wat de integriteit en vertrouwelijkheid van gegevens in gevaar kan brengen. De kwetsbaarheden omvatten ook ongeautoriseerde bestandsuploads en onjuiste toegang tot gegevens in KVStore-collecties, wat kan resulteren in ongeautoriseerde wijzigingen aan gevoelige data.

Oplossingen
Splunk heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 8

  • High 8.0
    CVE-2025-20229 EPSS 16%

    Remote Code Execution through file upload to “$SPLUNK_HOME/var/run/splunk/apptemp“ directory in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remo…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • High 7.1
    CVE-2025-20231

    Sensitive Information Disclosure in Splunk Secure Gateway App

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Medium 6.5
    CVE-2025-20228

    Maintenance mode state change of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF) in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Ke…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2025-20226

    Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk Enterprise

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search wit…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 5.7
    CVE-2025-20232

    Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise

    In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could ru…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20227

    Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles …

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20230

    Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App

    In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and del…

    Splunk Splunk Enterprise Splunk Secure Gateway
  • Low 2.5
    CVE-2025-20233

    Incorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File Editing

    In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the `chmod` and `makedirs` Python functions in a way that resulted in overly broad read and execute permissions. This could lead to improper access control for a low-priv…

    Splunk Splunk App for Lookup File Editing

Revision history

  1. #1.0.0

    Initiele versie

References