Splunk Add-on for Palo Alto Networks up to 2.0.1 Internal Index log file

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Splunk Add-on for Palo Alto Networks up to 2.0.1. Impacted is an unknown function of the component Internal Index. The manipulation leads to log file. This vulnerability is referenced as CVE-2025-20373. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Splunk Add-on for Palo Alto Networks up to 2.0.1 and classified as problematic. This issue affects an unknown functionality of the component Internal Index. The manipulation with an unknown input leads to a log file vulnerability. Using CWE to declare the problem leads to CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Impacted is confidentiality. The summary by CVE is:

In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new “Data Security Accounts“. The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) in the Splunk documentation for more information.

It is possible to read the advisory at advisory.splunk.com. The identification of this vulnerability is CVE-2025-20373 since 10/10/2024. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 2.0.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Add-on for Palo Alto Networks

Version

• 2.0.0
• 2.0.1

License

• free

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion