CVE-2025-20383 — Sensitive Information Exposure in Cloud Platform

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 83.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Splunk Cloud PlatformSplunk EnterpriseSplunk Secure Gateway+1 more
Timeline
PublishedDec 3

Description

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages6 packages

▶CVEListV5splunk/splunk_cloud_platform10.1.2507 — 10.1.2507.6+2
▶CVEListV5splunk/splunk_secure_gateway3.9 — 3.9.10+2
▶NVDsplunk/splunk_cloud_platform9.3.2411 — 9.3.2411.120+2
▶NVDsplunk/splunk_secure_gateway3.7.0 — 3.7.28+2
▶CVEListV5splunk/splunk_enterprise10.0 — 10.0.2+3

🔴Vulnerability Details

2
CVEList
Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app↗2025-12-03
▶
GHSA
GHSA-qw76-cw53-c7qx: In Splunk Enterprise versions below 10↗2025-12-03
▶