PT-2025-28236 · Splunk · Splunk Cloud Platform+1
Published
2025-07-07
·
Updated
2025-07-07
·
CVE-2025-20325
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Splunk Enterprise versions prior to 9.4.3
Splunk Enterprise versions prior to 9.3.5
Splunk Enterprise versions prior to 9.2.7
Splunk Enterprise versions prior to 9.1.10
Splunk Cloud Platform versions prior to 9.3.2411.103
Splunk Cloud Platform versions prior to 9.3.2408.113
Splunk Cloud Platform versions prior to 9.2.2406.119
Description:
The software potentially exposes the search head cluster
splunk.secret key if the Splunk Enterprise SHCConfig log channel is configured at the DEBUG logging level in a clustered deployment. This exposure could happen with either local access to the log files or administrative access to internal indexes. By default, only the admin role receives this access. Reviewing roles and capabilities on the instance and restricting internal index access to administrator-level roles is recommended.Recommendations:
For Splunk Enterprise versions prior to 9.4.3, update to version 9.4.3 or later.
For Splunk Enterprise versions prior to 9.3.5, update to version 9.3.5 or later.
For Splunk Enterprise versions prior to 9.2.7, update to version 9.2.7 or later.
For Splunk Enterprise versions prior to 9.1.10, update to version 9.1.10 or later.
For Splunk Cloud Platform versions prior to 9.3.2411.103, update to version 9.3.2411.103 or later.
For Splunk Cloud Platform versions prior to 9.3.2408.113, update to version 9.3.2408.113 or later.
For Splunk Cloud Platform versions prior to 9.2.2406.119, update to version 9.2.2406.119 or later.
As a temporary workaround, consider restricting the
SHCConfig log channel to a logging level other than DEBUG in the clustered deployment.
Restrict access to internal indexes to administrator-level roles to minimize the risk of exploitation.Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Splunk Cloud Platform
Splunk Enterprise