CVE-2025-20232 — Sensitive Information Exposure in Cloud Platform

CWE-200 — Sensitive Information ExposureCWE-416 — Use After Free4 documents4 sources
Severity
5.7MEDIUMNVD
EPSS
0.1%
top 79.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Splunk Cloud PlatformSplunk EnterpriseSplunk
Timeline
PublishedMar 26
Latest updateMar 27

Description

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a higher-privileged user to bypass the SPL safeguards for risky commands on the “/app/search/search“ endpoint through its “s“ parameter. The vulnerability requires the attacker t…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NExploitability: 2.1 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5splunk/splunk_cloud_platform9.3.2408 — 9.3.2408.103+4
▶NVDsplunk/splunk_cloud_platform9.1.2308 — 9.1.2308.212+4
▶CVEListV5splunk/splunk_enterprise9.3 — 9.3.3+2
▶NVDsplunk/splunk9.1.0 — 9.1.8+2

🔴Vulnerability Details

2
GHSA
GHSA-g97h-g237-c9p9: In Splunk Enterprise versions below 9↗2025-03-27
▶
CVEList
Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise↗2025-03-26
▶

📋Vendor Advisories

1
Microsoft
A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.↗2021-03-09
▶
CVE-2025-20232 — Sensitive Information Exposure | cvebase