Vulnerability in Splunk
CVE-2025-20230
In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value Store (KVStore) collections that the Splunk Secure Gateway app created. This is due to missing access control and incorrect ownership of the data in those KVStore collections.<br><br>In the affected versions, the `nobody` user owned the data in the KVStore collections. This meant that there was no specific owner assigned to the data in those collections.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (24.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 24.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- Splunk
- Splunk Enterprise — versions 9.4, 9.3, 9.2
- Splunk Secure Gateway — versions 3.8, 3.7
- Splunk Secure Gateway
Weakness classification (CWE)
References
- advisory.splunk.com/advisories/SVD-2025-0307 (Vendor Advisory)
Frequently asked questions
- What is CVE-2025-20230?
- CVE-2025-20230 is a medium-severity vulnerability in Splunk, classified under Improper Access Control. CVSS score: 4.3/10. Published 2025-03-26.
- How severe is CVE-2025-20230?
- Medium severity. CVSS v3 base score is 4.3 out of 10.