CVE-2025-20231

Summary

CVE-2025-20231 is a vulnerability affecting Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, as well as versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform. This issue allows a low-privileged user, who does not hold admin or power Splunk roles, to run a search using the permissions of a higher-privileged user. The vulnerability can lead to the disclosure of sensitive information. An attacker would need to trick the victim into initiating a request within their browser to exploit this phishing vulnerability, which the low-privileged user cannot do at will.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.