This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Splunk Enterprise and Secure Gateway fix 7 vulnerabilities

Splunk fixes 7 vulnerabilities in 2 products. The most severe of them are listed below; the remaining ones can be found at [3][4][5][6][7]. Individual products and their fixed versions: Splunk Enterprise - 9.4.1, 9.3.3, 9.2.5, 9.1.8 [1][2][3][4][5][6][7] Splunk Cloud Platform - 9.3.2408.107, 9.2.2406.113, 9.2.2403.115, 9.1.2312.208, 9.1.2308.214 [1][3][4][5][6] Splunk Secure Gateway - 3.8.38, 3.7.23 [2][7]

Splunk Enterprise, Cloud Platform - RCE (CVE-2025-20229)
CVSS 8.0 (High)

An authenticated remote attacker can execute code without authorization via the file upload functionality [1].

The vulnerability is present in products:

  • Splunk Enterprise; >=9.3.0, <9.3.3; >=9.2.0, <9.2.5; >=9.1.0, <9.1.8;
  • Splunk Cloud Platform; >=9.3.2408.100, <9.3.2408.104; >=9.2.2406.100, <9.2.2406.107; >=9.2.2403, <9.2.2403.114; >=9.1.2312, <9.1.2312.208;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 26. 3. 2025.

Splunk Enterprise, Secure Gateway - information disclosure (CVE-2025-20231)
CVSS 7.1 (High)

An authenticated remote attacker can access sensitive information from logs, such as authorization tokens [2].

The vulnerability is present in products:

  • Splunk Enterprise; ==9.4.0; >=9.3.0, <9.3.3; >=9.2.0, <9.2.5; >=9.1.0, <9.1.8;
  • Splunk Secure Gateway; <3.7.23; >=3.8, <3.8.38;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 26. 3. 2025.

By CESNET, z.s.p.o. Martin Krajči on 31. 3. 2025.

CESNET, z.s.p.o. Logo