PT-2025-28234 · Splunk · Splunk Enterprise

Anton · Published 2025-07-07 · Updated 2025-07-22 · CVE-2025-20323

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.4.3 Splunk Enterprise versions prior to 9.3.5 Splunk Enterprise versions prior to 9.2.7 Splunk Enterprise versions prior to 9.1.10

Description: A low-privileged user without the "admin" or "power" Splunk roles could turn off the scheduled search Bucket Copy Trigger within the Splunk Archiver application due to missing access controls in the saved searches for this app.

Recommendations: For versions prior to 9.4.3, update to version 9.4.3 or later. For versions prior to 9.3.5, update to version 9.3.5 or later. For versions prior to 9.2.7, update to version 9.2.7 or later. For versions prior to 9.1.10, update to version 9.1.10 or later.

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-20323

Affected Products

Splunk Enterprise

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-20323 · Security Note
• https://advisory.splunk.com/advisories/SVD-2025-0706 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-20323 · Vendor Advisory
• https://twitter.com/CVEnew/status/1942280697571397949 · Twitter Post
• https://twitter.com/dailycve/status/1947447294632006045 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1942463196457021945 · Twitter Post