Splunk Security Updates – 27 March 2025

The addressed vulnerabilities could allow the attacker to bypass security restrictions, obtain sensitive information, gain elevated privileges, or execute arbitrary code and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Code Execution Vulnerability through File Upload in Splunk Enterprise (CVE-2025-20229):

• CVSS: 8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Consequences: Gain Access

2. Information Disclosure Vulnerability in Splunk Secure Gateway App (CVE2025-20231):

• CVSS: 7.1
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: Low
• User Interaction: Required
• Consequences: Obtain Information

Sample of the affected products:

• Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8.
• Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208.
• Splunk Secure Gateway app on Splunk Cloud Platform versions below 3.8.38 and 3.7.23.