CVE-2025-20383
📋 TL;DR
This vulnerability allows low-privileged Splunk users who subscribe to mobile push notifications to receive notification titles and descriptions for reports or alerts they don't have permission to view. It affects Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Secure Gateway app versions below 3.9.10, 3.8.58, and 3.7.28 in Splunk Cloud Platform.
💻 Affected Systems
- Splunk Enterprise
- Splunk Secure Gateway app
📦 What is this software?
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
Splunk by Splunk
⚠️ Risk & Real-World Impact
Worst Case
Sensitive information from restricted reports/alerts is disclosed to unauthorized users, potentially revealing confidential business intelligence, security findings, or operational data.
Likely Case
Low-privileged users inadvertently gain visibility into report/alert metadata they shouldn't see, creating information leakage but not full report access.
If Mitigated
Information disclosure limited to notification metadata only, with no access to actual report content or alert details.
🎯 Exploit Status
Exploitation requires a legitimate low-privileged user account and mobile notification subscription.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Splunk Enterprise: 10.0.2, 9.4.6, 9.3.8, 9.2.10; Splunk Secure Gateway: 3.9.10, 3.8.58, 3.7.28
Vendor Advisory: https://advisory.splunk.com/advisories/SVD-2025-1202
Restart Required: Yes
Instructions:
1. Download appropriate patched version from Splunk downloads page. 2. Backup current installation. 3. Install update following Splunk upgrade documentation. 4. Restart Splunk services.
🔧 Temporary Workarounds
Disable mobile push notifications
allTemporarily disable mobile push notification feature to prevent information disclosure.
Navigate to Settings > Server settings > Mobile push notifications > Disable
Restrict notification subscriptions
allLimit which users can subscribe to mobile notifications through role-based access controls.
Edit role permissions to remove 'subscribe_to_notifications' capability
🧯 If You Can't Patch
- Review and audit all user roles to ensure proper separation of duties
- Monitor notification logs for unusual access patterns to restricted reports
🔍 How to Verify
Check if Vulnerable:
Check Splunk version via web interface (Settings > Server Info) or command line, compare against affected versions.Check Version:
On Splunk server: $SPLUNK_HOME/bin/splunk versionVerify Fix Applied:
After patching, verify version is at or above patched versions, test notification permissions with low-privileged user.📡 Detection & Monitoring
Log Indicators:
- Audit logs showing notification access to reports by unauthorized users
- Mobile notification delivery logs with sensitive metadata
Network Indicators:
- Increased mobile notification traffic to low-privileged users
SIEM Query:
index=_audit action=notification user=* NOT (role=admin OR role=power) | search report_title=*