Product:
Splunk Enterprise for Windows
Summary
In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation or an upgrade can lead to incorrect permissions assignment in the installation directory. This vulnerability allows non-administrator users to access the directory and its contents, posing a significant security risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8 | CVE-2025-20386 |
Exploitation
To exploit this vulnerability, an attacker must have access to the affected system as a non-administrator user. By leveraging the incorrect permissions, the attacker can access sensitive data within the Splunk Enterprise installation directory. This could lead to unauthorized data exposure or manipulation, depending on the contents of the directory.
Affected Products
- Splunk Enterprise for Windows versions below 10.0.2
- Splunk Enterprise for Windows versions below 9.4.6
- Splunk Enterprise for Windows versions below 9.3.8
- Splunk Enterprise for Windows versions below 9.2.10
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Splunk Enterprise for Windows that addresses the permissions issue. Regularly reviewing and adjusting directory permissions can also help prevent unauthorized access.