CVE-2025-20227

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2025-0306	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:::::enterprise:::*
	cpe:2.3:a:splunk:splunk:9.4.0::::enterprise:::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::
	cpe:2.3:a:splunk:splunk_cloud_platform::::::::

History

No history.

Information

Published : 2025-03-26 22:15

Updated : 2025-07-21 20:51

NVD link : CVE-2025-20227

Mitre link : CVE-2025-20227

CVE.ORG link : CVE-2025-20227

JSON object : View

Products Affected

splunk

splunk_cloud_platform
splunk

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-20227", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-03-26T22:15:14.637", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-0306", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise anteriores a 9.4.1, 9.3.3, 9.2.5 y 9.1.8, y en las versiones de Splunk Cloud Platform anteriores a 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 y 9.1.2308.214, un usuario con pocos privilegios que no tenga los roles de \"admin\" o \"power\" de Splunk podr\u00eda omitir el cuadro de di\u00e1logo modal de advertencia de contenido externo en los paneles de Dashboard Studio, lo que podr\u00eda provocar una divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2025-07-21T20:51:45.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "49EE75F0-2AD6-4712-9E2A-C000A44E5605", "versionEndExcluding": "9.1.8", "versionStartIncluding": "9.1.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E31DE8DF-1AAD-4570-93E3-711C07FE1227", "versionEndExcluding": "9.2.4", "versionStartIncluding": "9.2.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E66E66BA-AFC2-4E0A-B233-9E2C7D985AF0", "versionEndExcluding": "9.3.3", "versionStartIncluding": "9.3.0"}, {"criteria": "cpe:2.3:a:splunk:splunk:9.4.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "AD39F156-52DB-4F43-8528-37500E3AEB89"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E95F34F-276A-4B6C-B317-DB58839B34CE", "versionEndExcluding": "9.1.2308.214", "versionStartIncluding": "9.1.2308"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE9FAFD0-7787-425C-81D9-705E99B53E6A", "versionEndExcluding": "9.1.2312.208", "versionStartIncluding": "9.1.2312"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A79896AF-1111-47AE-A84E-9D897BF2031C", "versionEndExcluding": "9.2.2403.115", "versionStartIncluding": "9.2.2403"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "000487DA-0E58-4953-A4BD-BEF09D825246", "versionEndExcluding": "9.2.2406.113", "versionStartIncluding": "9.2.2406.100"}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0D477D5-C135-4D18-BC7D-94D4A5F34E1D", "versionEndExcluding": "9.3.2408.107", "versionStartIncluding": "9.3.2408.100"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}