VULNERABILITY INTELLIGENCE

CVE-2025-20383

CVSS score4.3 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2025-12-03
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Secure Gateway app in Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles and subscribes to mobile push notifications could receive notifications that disclose the title and description of the report or alert even if they do not have access to view the report or alert.

Weakness classification

  • psirt@cisco.com: CWE-200
  • nvd@nist.gov: NVD-CWE-Other

Primary references