CVE-2025-20232

Summary

CVE-2025-20232 is a vulnerability affecting Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, as well as Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208, and 9.1.2308.212. A low-privileged user, without the "admin" or "power" roles, can execute a risky command using the permissions of a higher-privileged user by manipulating the "s" parameter on the "/app/search/search" endpoint. The attack requires the attacker to convince the victim to initiate a request through their browser, making it a phishing vulnerability. The exploitation is not straightforward, as the authenticated user cannot abuse this vulnerability at will.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.