Splunk Enterprise/Secure Gateway App Key Value Store access control

Summaryinfo

A vulnerability identified as critical has been detected in Splunk Enterprise and Secure Gateway. This affects an unknown function of the component App Key Value Store. Performing a manipulation results in access control. This vulnerability is known as CVE-2025-20230. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Splunk Enterprise and Secure Gateway (affected version not known). This affects some unknown functionality of the component App Key Value Store. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on integrity, and availability. The summary by CVE is:

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could edit and delete other user data in App Key Value Store (KVStore) collections that the Splunk Secure Gateway app created. This is due to missing access control and incorrect ownership of the data in those KVStore collections.In the affected versions, the `nobody` user owned the data in the KVStore collections. This meant that there was no specific owner assigned to the data in those collections.

The advisory is shared at advisory.splunk.com. This vulnerability is uniquely identified as CVE-2025-20230 since 10/10/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 233365 (Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3, 9.4.0 < 9.4.1 (SVD-2025-0307)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (233365). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Enterprise
• Secure Gateway

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion