Splunk Enterprise 9.2.0 < 9.2.8, 9.3.0 < 9.3.6, 9.4.0 < 9.4.4 (SVD-2025-1001)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(266443);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/03");

  script_cve_id("CVE-2025-20366");

  script_name(english:"Splunk Enterprise 9.2.0 < 9.2.8, 9.3.0 < 9.3.6, 9.4.0 < 9.4.4 (SVD-2025-1001)");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by a vulnerability");
  script_set_attribute(attribute:"description", value:
"The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a
vulnerability as referenced in the SVD-2025-1001 advisory.

  - In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below
    9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user that does not hold the admin or power
    Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job
    in the background. If the low privileged user guesses the search job's unique Search ID (SID), the user
    could retrieve the results of that job, potentially exposing sensitive search results. For more
    information see https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/about-
    jobs-and-job-management and https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-
    jobs/manage-search-jobs. (CVE-2025-20366)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://advisory.splunk.com/advisories/SVD-2025-1001.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Splunk Enterprise to versions 9.4.4, 9.3.6, 9.2.8, or higher.Splunk is actively monitoring and patching Splunk
Cloud Platform instances.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20366");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/03");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:splunk:splunk");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("splunkd_detect.nasl", "splunk_web_detect.nasl", "macos_splunk_installed.nbin", "splunk_win_installed.nbin", "splunk_nix_installed.nbin");
  script_require_keys("installed_sw/Splunk", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_splunk.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::splunk::get_app_info();

var constraints = [
  { 'min_version' : '9.2.0', 'fixed_version' : '9.2.8', 'license' : 'Enterprise' },
  { 'min_version' : '9.3.0', 'fixed_version' : '9.3.6', 'license' : 'Enterprise' },
  { 'min_version' : '9.4.0', 'fixed_version' : '9.4.4', 'license' : 'Enterprise' }
];
vcf::splunk::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);