CVE-2025-20228

Description

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the "admin" or "power" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).

Reserved 2024-10-10 | Published 2025-03-26 | Updated 2025-03-27 | Assigner cisco

Problem types

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Product status

9.3 before 9.3.3
affected

9.2 before 9.2.5
affected

9.1 before 9.1.8
affected

9.2.2403 before 9.2.2403.108
affected

9.1.2312 before 9.1.2312.204
affected

Credits

Anton (therceman)

References

advisory.splunk.com/advisories/SVD-2025-0303

cve.org (CVE-2025-20228)

nvd.nist.gov (CVE-2025-20228)

Download JSON