CVE-2025-20383 json
Improper access control through push notifications for reports and alerts in Splunk Secure Gateway app
published 2025-12-03 11 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-200992
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.
Patch / fix
- Splunk Splunk Enterprise 9.2.10, 9.3.8, 9.4.6, 10.0.2
- Splunk Splunk Cloud Platform 9.3.2411.120, 10.0.2503.8, 10.1.2507.6
- Splunk Splunk Secure Gateway 3.7.28, 3.8.58, 3.9.10
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected products
- Splunk Splunk Enterprise
- Splunk Splunk Cloud Platform
- Splunk Splunk Secure Gateway
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
advisory.splunk.com
/advisories/SVD-2025-1202
vendor-advisory
Sources
- CVE List CVE-2025-20383
- NVD CVE-2025-20383
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.