CVE-2025-20227CWE-20

Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio

Medium · published March 26, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.1th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-03-26T22:03Z
EPSS history
Timeline
  • 26 MAR 22:03Z
    Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio
    cvelistv5