Skip to content
OpenAdvisories
High NCSC-2025-0381 8 CVEs

Kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform

Published Dec 8, 2025 · Updated Dec 8, 2025 · nl

Vendor: Splunk Product: Cloud Platform Product: Enterprise Product: Secure Gateway

Summary

Splunk heeft kwetsbaarheden verholpen in Splunk Enterprise en Splunk Cloud Platform.

Details

Interpretaties
De kwetsbaarheden omvatten verschillende problemen, waaronder de mogelijkheid voor laaggeprivilegieerde gebruikers om ongeautoriseerde dashboards te creëren, toegang te krijgen tot gevoelige informatie via mobiele meldingen, en de injectie van ANSI-escape codes in logbestanden. Daarnaast kunnen hooggeprivilegieerde gebruikers ongeautoriseerde JavaScript-code uitvoeren, en zijn er problemen met onjuiste machtigingen die niet-beheerders toegang geven tot installatiebestanden. Deze kwetsbaarheden kunnen leiden tot ongeautoriseerde toegang tot gevoelige gegevens en verstoringen van de applicatiefuncties, wat de integriteit en beschikbaarheid van de systemen in gevaar brengt.

Oplossingen
Splunk heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 8

  • High 8.0
    CVE-2025-20386

    Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade

    In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets …

    Splunk Splunk Enterprise
  • High 8.0
    CVE-2025-20387

    Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade

    In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory.…

    Splunk Splunk Enterprise
  • Medium 5.3
    CVE-2025-20384 Public exploit

    Unauthenticated Log Injection in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes int…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Medium 4.3
    CVE-2025-20383

    Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mo…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • Medium 4.3
    CVE-2025-20389

    Improper Input Validation in "label" column field in Splunk Secure Gateway App

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cr…

    Splunk Splunk Enterprise Splunk Cloud Platform Splunk Secure Gateway
  • Low 3.5
    CVE-2025-20382

    URL validation bypass through Views Dashboard in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a views dashb…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 2.7
    CVE-2025-20388

    Blind Server Side Request Forgery (SSRF) through Distributed Search Peers in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.7, and 9.3.2411.116, a user who holds a role that contains the high privilege capability `change_authentication` could enumer…

    Splunk Splunk Enterprise Splunk Cloud Platform
  • Low 2.4
    CVE-2025-20385

    Stored Cross-Site scripting (XSS) through Anchor Tag "href" in Navigation Bar Collections in Splunk Enterprise

    In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.6, 10.0.2503.7, and 9.3.2411.117, a user who holds a role with a high privilege capability `admin_all_objects` could craft a malicious pay…

    Splunk Splunk Enterprise Splunk Cloud Platform

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://advisory.splunk.com//advisories/SVD-2025-1201
  • Reference
    https://advisory.splunk.com//advisories/SVD-2025-1202
  • Reference
    https://advisory.splunk.com//advisories/SVD-2025-1203
  • Reference
    https://advisory.splunk.com//advisories/SVD-2025-1204
  • Reference
    https://advisory.splunk.com//advisories/SVD-2025-1205
  • Reference
    https://advisory.splunk.com//advisories/SVD-2025-1206
  • Reference
    https://advisory.splunk.com//advisories/SVD-2025-1207
  • Reference
    https://advisory.splunk.com//advisories/SVD-2025-1208