Product:
Splunk Universal Forwarder for Windows
Summary
In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation or an upgrade can lead to incorrect permissions in the installation directory. This vulnerability allows non-administrator users to access the directory and its contents, posing a significant security risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8 | CVE-2025-20387 |
Exploitation
To exploit this vulnerability, an attacker must have access to a machine where an affected version of Splunk Universal Forwarder for Windows is installed. By performing a new installation or an upgrade, the attacker can manipulate the permissions, allowing unauthorized access to sensitive files and directories.
Affected Products
- Splunk Universal Forwarder for Windows versions below 10.0.2
- Splunk Universal Forwarder for Windows versions below 9.4.6
- Splunk Universal Forwarder for Windows versions below 9.3.8
- Splunk Universal Forwarder for Windows versions below 9.2.10
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Splunk Universal Forwarder for Windows that addresses the permissions issue. Regularly reviewing and adjusting directory permissions can also help prevent unauthorized access.