Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user could access sensitive search results if an administrative search job runs in the background. If the user guesses the search job’s unique Search ID, they could retrieve the results, potentially exposing sensitive information.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-20366 |
Exploitation
To exploit this vulnerability, a low-privileged user must guess the unique Search ID of an administrative search job that is running in the background. Once the user has the correct Search ID, they can access the sensitive search results associated with that job, which could lead to unauthorized exposure of confidential information.
Affected Products
- Splunk Enterprise versions below 9.4.4
- Splunk Enterprise versions below 9.3.6
- Splunk Enterprise versions below 9.2.8
- Splunk Cloud Platform versions below 9.3.2411.111
- Splunk Cloud Platform versions below 9.3.2408.119
- Splunk Cloud Platform versions below 9.2.2406.122
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform. Additionally, organizations should implement strict access controls and monitor administrative search jobs to prevent unauthorized access to sensitive search results.