CVE-2025-20383

published 2025-12-03

CVE-2025-20383: In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud…

Priority P4 23 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
splunk	splunk	>= 10.0.0 < 10.0.2	10.0.2
splunk	splunk	>= 9.2.0 < 9.2.10	9.2.10
splunk	splunk	>= 9.3.0 < 9.3.8	9.3.8
splunk	splunk	>= 9.4.0 < 9.4.6	9.4.6
splunk	splunk_cloud_platform	>= 10.0.2503 < 10.0.2503.8	10.0.2503.8
splunk	splunk_cloud_platform	>= 10.1.2507 < 10.1.2507.6	10.1.2507.6
splunk	splunk_cloud_platform	>= 9.3.2411 < 9.3.2411.120	9.3.2411.120
splunk	splunk_enterprise	>= 10.0 < 10.0.2	10.0.2
splunk	splunk_enterprise	>= 9.2 < 9.2.10	9.2.10
splunk	splunk_enterprise	>= 9.3 < 9.3.8	9.3.8
splunk	splunk_enterprise	>= 9.4 < 9.4.6	9.4.6
splunk	splunk_secure_gateway	>= 3.7 < 3.7.28	3.7.28
splunk	splunk_secure_gateway	>= 3.7.0 < 3.7.28	3.7.28
splunk	splunk_secure_gateway	>= 3.8 < 3.8.58	3.8.58
splunk	splunk_secure_gateway	>= 3.8.0 < 3.8.58	3.8.58
splunk	splunk_secure_gateway	>= 3.9 < 3.9.10	3.9.10
splunk	splunk_secure_gateway	>= 3.9.0 < 3.9.10	3.9.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200