CVE-2025-20229

Description

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK_HOME/var/run/splunk/apptemp" directory due to missing authorization checks.

Reserved 2024-10-10 | Published 2025-03-26 | Updated 2025-03-28 | Assigner cisco

Problem types

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Product status

9.4 before 9.4.0
affected

9.3 before 9.3.3
affected

9.2 before 9.2.5
affected

9.1 before 9.1.8
affected

9.3.2408 before 9.3.2408.104
affected

9.2.2406 before 9.2.2406.108
affected

9.2.2403 before 9.2.2403.114
affected

9.1.2312 before 9.1.2312.208
affected

Credits

Alex Hordijk (hordalex)

References

advisory.splunk.com/advisories/SVD-2025-0301

cve.org (CVE-2025-20229)

nvd.nist.gov (CVE-2025-20229)

Download JSON