CVE-2025-20226 — Sensitive Information Exposure in Cloud Platform

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
5.7MEDIUMNVD
EPSS
0.1%
top 79.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Splunk Cloud PlatformSplunk EnterpriseSplunk
Timeline
PublishedMar 26
Latest updateMar 27

Description

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on the "/services/streams/search" endpoint through its "q" parameter. The vulnerability requires the attacker to phish the vi…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NExploitability: 2.1 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5splunk/splunk_cloud_platform9.3.2408 — 9.3.2408.107+2
▶NVDsplunk/splunk_cloud_platform9.1.2308 — 9.1.2308.214+2
▶CVEListV5splunk/splunk_enterprise9.4 — 9.4.1+3
▶NVDsplunk/splunk9.1.0 — 9.1.8+3

🔴Vulnerability Details

2
GHSA
GHSA-c8hx-mpvv-3952: In Splunk Enterprise versions below 9↗2025-03-27
▶
CVEList
Risky command safeguards bypass in “/services/streams/search“ endpoint through “q“ parameter in Splunk Enterprise↗2025-03-26
▶
CVE-2025-20226 — Sensitive Information Exposure | cvebase