CVE-2025-20232

🗓️ 26 Mar 2025 22:06:00Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 82 Views🌐 WEB

Vulnerability allows low-privileged users to exploit higher-privileged roles in Splunk Enterprise and Cloud.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-20232	26 Mar 202523:55	–	circl
CNNVD	Splunk Cloud Platform和Splunk Enterprise 信息泄露漏洞	26 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-20232 Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise	26 Mar 202522:06	–	cvelist
EUVD	EUVD-2025-8427	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform	27 Mar 202509:18	–	ncsc
NVD	CVE-2025-20232	26 Mar 202522:15	–	nvd
OSV	CVE-2025-20232	26 Mar 202522:15	–	osv
Positive Technologies	PT-2025-13016 · Splunk · Splunk Cloud Platform +1	26 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-20232	28 Mar 202522:41	–	redhatcve
Tenable Nessus	Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3 (SVD-2025-0304)	26 Mar 202500:00	–	nessus

NVD

Node

splunk splunkRange9.1.0–9.1.8enterprise

splunk splunkRange9.2.0–9.2.5enterprise

splunk splunkRange9.3.0–9.3.3enterprise

splunk splunk_cloud_platformRange9.1.2308–9.1.2308.212

splunk splunk_cloud_platformRange9.1.2312.100–9.1.2312.208

splunk splunk_cloud_platformRange9.2.2403.100–9.2.2403.113

splunk splunk_cloud_platformRange9.2.2406.100–9.2.2406.108

splunk splunk_cloud_platformRange9.3.2408.100–9.3.2408.103

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "9.3",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.3.3"
      },
      {
        "version": "9.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.2.5"
      },
      {
        "version": "9.1",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.8"
      }
    ]
  },
  {
    "product": "Splunk Cloud Platform",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "9.3.2408",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.3.2408.103"
      },
      {
        "version": "9.2.2406",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.2.2406.108"
      },
      {
        "version": "9.2.2403",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.2.2403.113"
      },
      {
        "version": "9.1.2312",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2312.208"
      },
      {
        "version": "9.1.2308",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.1.2308.212"
      }
    ]
  }
]

Source	Link
advisory	www.advisory.splunk.com/advisories/SVD-2025-0304

Parameter	Position	Path	Description	CWE
s	query param	/app/search/search	Low-privileged user can exploit the saved search via the /app/search/search endpoint by abusing the s parameter to execute a risky command and bypass SPL safeguards.	CWE-200

21 Jul 2025 20:45Current

7.2High risk

Vulners AI Score7.2

CVSS 3.15.7

EPSS0.00053

SSVC

CWE-200

cve-2025-20232 splunk vulnerability low-privileged user higher-privileged roles phishing risk command