CVE-2025-20231: Sensitive Information Disclosure in Splunk Secure Gateway App
In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a search using the permissions of a higher-privileged user that could lead to disclosure of sensitive information.<br><br>The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The authenticated low-privileged user should not be able to exploit the vulnerability at will.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-20231?
The severity of CVE-2025-20231 is assessed as low, indicating that it poses a limited risk to systems.
How do I fix CVE-2025-20231?
To fix CVE-2025-20231, update to Splunk Enterprise version 9.4.1 or higher, or install the latest version of the Splunk Secure Gateway app.
Who is affected by CVE-2025-20231?
CVE-2025-20231 affects users of Splunk Enterprise versions below 9.4.1 and specific versions of the Splunk Secure Gateway app.
What can a low-privileged user do with CVE-2025-20231?
A low-privileged user can run searches with elevated permissions, which can lead to unauthorized data access.
Are there any workarounds for CVE-2025-20231?
Currently, no specific workarounds have been recommended for CVE-2025-20231 outside of upgrading the affected software.