CVE-2025-20230
Missing Access Control and Incorrect Ownership of Data in App Key Value Store (KVStore) collections in the Splunk Secure Gateway App
At a glance
- Source
- NVD
- EPSS
- EPSS 0.33 % · percentile 25 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Analyzed
Description
In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value Store (KVStore) collections that the Splunk Secure Gateway app created. This is due to missing access control and incorrect ownership of the data in those KVStore collections.<br><br>In the affected versions, the `nobody` user owned the data in the KVStore collections. This meant that there was no specific owner assigned to the data in those collections.
Weaknesses (CWE)
- CWE-284 — Improper Access Control
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | cisco |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | NVD · psirt@cisco.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2025-8429
- GCVE · GCVE-0-2025-20230
CERT-FR advisories
- CERTFR-2025-AVI-0245 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.1.0 < 9.1.8cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.2.0 < 9.2.5cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.3.0 < 9.3.3cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.4.0 < 9.4.1cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*≥ 3.7.0 < 3.7.23cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*≥ 3.8.0 < 3.8.38
Affected products
| Product | Versions |
|---|---|
| Splunk · Splunk Enterprise | affected 9.4 < 9.4.1 ; affected 9.3 < 9.3.3 ; affected 9.2 < 9.2.5 ; affected 9.1 < 9.1.8 |
| Splunk · Splunk Secure Gateway | affected 3.8 < 3.8.38 ; affected 3.7 < 3.7.23 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |