CVE-2025-20227

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-20227", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2024-10-10T19:15:13.236Z", "datePublished": "2025-03-26T22:03:50.424Z", "dateUpdated": "2025-03-27T13:50:15.585Z"}, "containers": {"cna": {"affected": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"version": "9.4", "status": "affected", "versionType": "custom", "lessThan": "9.4.1"}, {"version": "9.3", "status": "affected", "versionType": "custom", "lessThan": "9.3.3"}, {"version": "9.2", "status": "affected", "versionType": "custom", "lessThan": "9.2.5"}, {"version": "9.1", "status": "affected", "versionType": "custom", "lessThan": "9.1.8"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"version": "9.3.2408", "status": "affected", "versionType": "custom", "lessThan": "9.3.2408.107"}, {"version": "9.2.2406", "status": "affected", "versionType": "custom", "lessThan": "9.2.2406.113"}, {"version": "9.2.2403", "status": "affected", "versionType": "custom", "lessThan": "9.2.2403.115"}, {"version": "9.1.2312", "status": "affected", "versionType": "custom", "lessThan": "9.1.2312.208"}, {"version": "9.1.2308", "status": "affected", "versionType": "custom", "lessThan": "9.1.2308.214"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure."}], "value": "In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure."}], "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-0306"}], "title": "Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio", "datePublic": "2025-03-26T00:00:00.000Z", "metrics": [{"cvssV3_1": {"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "description": "The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.", "cweId": "CWE-20"}]}], "source": {"advisory": "SVD-2025-0306"}, "credits": [{"lang": "en", "value": "Taihei Shimamine"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-03-26T22:03:50.424Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-27T13:50:08.258188Z", "id": "CVE-2025-20227", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T13:50:15.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20227", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-27T13:50:08.258188Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T13:50:11.927Z"}}], "cna": {"title": "Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio", "source": {"advisory": "SVD-2025-0306"}, "credits": [{"lang": "en", "value": "Taihei Shimamine"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Splunk", "product": "Splunk Enterprise", "versions": [{"status": "affected", "version": "9.4", "lessThan": "9.4.1", "versionType": "custom"}, {"status": "affected", "version": "9.3", "lessThan": "9.3.3", "versionType": "custom"}, {"status": "affected", "version": "9.2", "lessThan": "9.2.5", "versionType": "custom"}, {"status": "affected", "version": "9.1", "lessThan": "9.1.8", "versionType": "custom"}]}, {"vendor": "Splunk", "product": "Splunk Cloud Platform", "versions": [{"status": "affected", "version": "9.3.2408", "lessThan": "9.3.2408.107", "versionType": "custom"}, {"status": "affected", "version": "9.2.2406", "lessThan": "9.2.2406.113", "versionType": "custom"}, {"status": "affected", "version": "9.2.2403", "lessThan": "9.2.2403.115", "versionType": "custom"}, {"status": "affected", "version": "9.1.2312", "lessThan": "9.1.2312.208", "versionType": "custom"}, {"status": "affected", "version": "9.1.2308", "lessThan": "9.1.2308.214", "versionType": "custom"}]}], "datePublic": "2025-03-26T00:00:00.000Z", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-0306"}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure.", "supportingMedia": [{"type": "text/html", "value": "In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-20", "description": "The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program."}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2025-03-26T22:03:50.424Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20227", "state": "PUBLISHED", "dateUpdated": "2025-03-27T13:50:15.585Z", "dateReserved": "2024-10-10T19:15:13.236Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2025-03-26T22:03:50.424Z", "assignerShortName": "cisco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Splunk Enterprise", "vendor": "Splunk", "versions": [{"lessThan": "9.4.1", "status": "affected", "version": "9.4", "versionType": "custom"}, {"lessThan": "9.3.3", "status": "affected", "version": "9.3", "versionType": "custom"}, {"lessThan": "9.2.5", "status": "affected", "version": "9.2", "versionType": "custom"}, {"lessThan": "9.1.8", "status": "affected", "version": "9.1", "versionType": "custom"}]}, {"product": "Splunk Cloud Platform", "vendor": "Splunk", "versions": [{"lessThan": "9.3.2408.107", "status": "affected", "version": "9.3.2408", "versionType": "custom"}, {"lessThan": "9.2.2406.113", "status": "affected", "version": "9.2.2406", "versionType": "custom"}, {"lessThan": "9.2.2403.115", "status": "affected", "version": "9.2.2403", "versionType": "custom"}, {"lessThan": "9.1.2312.208", "status": "affected", "version": "9.1.2312", "versionType": "custom"}, {"lessThan": "9.1.2308.214", "status": "affected", "version": "9.1.2308", "versionType": "custom"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "49EE75F0-2AD6-4712-9E2A-C000A44E5605", "versionEndExcluding": "9.1.8", "versionStartIncluding": "9.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "E31DE8DF-1AAD-4570-93E3-711C07FE1227", "versionEndExcluding": "9.2.4", "versionStartIncluding": "9.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "E66E66BA-AFC2-4E0A-B233-9E2C7D985AF0", "versionEndExcluding": "9.3.3", "versionStartIncluding": "9.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk:9.4.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "AD39F156-52DB-4F43-8528-37500E3AEB89", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E95F34F-276A-4B6C-B317-DB58839B34CE", "versionEndExcluding": "9.1.2308.214", "versionStartIncluding": "9.1.2308", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE9FAFD0-7787-425C-81D9-705E99B53E6A", "versionEndExcluding": "9.1.2312.208", "versionStartIncluding": "9.1.2312", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "A79896AF-1111-47AE-A84E-9D897BF2031C", "versionEndExcluding": "9.2.2403.115", "versionStartIncluding": "9.2.2403", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "000487DA-0E58-4953-A4BD-BEF09D825246", "versionEndExcluding": "9.2.2406.113", "versionStartIncluding": "9.2.2406.100", "vulnerable": true}, {"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "E0D477D5-C135-4D18-BC7D-94D4A5F34E1D", "versionEndExcluding": "9.3.2408.107", "versionStartIncluding": "9.3.2408.100", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise anteriores a 9.4.1, 9.3.3, 9.2.5 y 9.1.8, y en las versiones de Splunk Cloud Platform anteriores a 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 y 9.1.2308.214, un usuario con pocos privilegios que no tenga los roles de \"admin\" o \"power\" de Splunk podr\u00eda omitir el cuadro de di\u00e1logo modal de advertencia de contenido externo en los paneles de Dashboard Studio, lo que podr\u00eda provocar una divulgaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2025-20227", "lastModified": "2026-06-17T08:41:08.080", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "psirt@cisco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20227", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-27T13:50:08.258188Z", "version": "2.0.3"}}]}, "published": "2025-03-26T22:15:14.637", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://advisory.splunk.com/advisories/SVD-2025-0306"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T15:26:22.918602+00:00", "updated": "2025-07-12T15:26:22.918649+00:00", "vendors": ["splunk", "splunk$PRODUCT$splunk_cloud_platform", "splunk$PRODUCT$splunk_enterprise"]}