← Back

CVE-2025-20383

nvd nist
Published: Dec 3, 2025Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: psirt@cisco.com (Secondary)

Description

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.

Affected (10)

Splunk
3 products
Splunk
Splunk Cloud Platform
Splunk Secure Gateway
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Splunk
Splunk
From 10.0.0 to 10.0.2
Splunk
From 9.2.0 to 9.2.10
Splunk
From 9.3.0 to 9.3.8
Splunk
From 9.4.0 to 9.4.6
Splunk
Splunk Cloud Platform
From 10.0.2503 to 10.0.2503.8
Splunk Cloud Platform
From 10.1.2507 to 10.1.2507.6
Splunk Cloud Platform
From 9.3.2411 to 9.3.2411.120
Splunk
Splunk Secure Gateway
From 3.7.0 to 3.7.28
Splunk Secure Gateway
From 3.8.0 to 3.8.58
Splunk Secure Gateway
From 3.9.0 to 3.9.10

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (1)

Source: psirt@cisco.com
Vendor Advisory

Timeline

No history available yet.