PT-2025-13014 · Splunk · Splunk Cloud Platform+1

Alex Hordijk

·

Published

2025-03-26

·

Updated

2025-07-21

·

CVE-2025-20229

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.3.3 Splunk Enterprise versions prior to 9.2.5 Splunk Enterprise versions prior to 9.1.8 Splunk Cloud Platform versions prior to 9.3.2408.104 Splunk Cloud Platform versions prior to 9.2.2406.108 Splunk Cloud Platform versions prior to 9.2.2403.114 Splunk Cloud Platform versions prior to 9.1.2312.208
Description A low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE) through a file upload to the "$SPLUNK HOME/var/run/splunk/apptemp" directory due to missing authorization checks. This issue allows attackers to execute arbitrary code by uploading malicious files. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.
Recommendations For Splunk Enterprise versions prior to 9.3.3, update to version 9.3.3 or later. For Splunk Enterprise versions prior to 9.2.5, update to version 9.2.5 or later. For Splunk Enterprise versions prior to 9.1.8, update to version 9.1.8 or later. For Splunk Cloud Platform versions prior to 9.3.2408.104, update to version 9.3.2408.104 or later. For Splunk Cloud Platform versions prior to 9.2.2406.108, update to version 9.2.2406.108 or later. For Splunk Cloud Platform versions prior to 9.2.2403.114, update to version 9.2.2403.114 or later. For Splunk Cloud Platform versions prior to 9.1.2312.208, update to version 9.1.2312.208 or later. As a temporary workaround, consider restricting access to the "$SPLUNK HOME/var/run/splunk/apptemp" directory until a patch is available.

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-03529
CVE-2025-20229

Affected Products

Splunk Cloud Platform
Splunk Enterprise