PT-2025-48163 · Splunk · Splunk Add-On For Palo Alto Networks

Published 2025-11-26 · Updated 2025-11-26 · CVE-2025-20373

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Splunk Add-on for Palo Alto Networks versions prior to 2.0.2

Description The Splunk Add-on for Palo Alto Networks exposes client secrets in plain text within the internal index when new “Data Security Accounts” are added. Exploitation requires either local access to log files or administrative access to internal indexes, which, by default, is limited to the admin role.

Recommendations Restrict access to the internal index to administrator-level roles. Review roles and capabilities on your instance.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-20373

Affected Products

Splunk Add-On For Palo Alto Networks

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-20373 · Security Note
• https://advisory.splunk.com/advisories/SVD-2025-1105 · Note
• https://twitter.com/VulmonFeeds/status/1993788492631953737 · Twitter Post
• https://t.me/CVEtracker/38301 · Telegram Post
• https://twitter.com/CVEnew/status/1993746741254848602 · Twitter Post