CVE-2025-20229
Published: 26 March 2025
Summary
CVE-2025-20229 is a high-severity Improper Access Control (CWE-284) vulnerability in Splunk Splunk. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-20229 is an improper access control vulnerability, tracked as CWE-284, that affects Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 as well as Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208. The flaw stems from missing authorization checks on file uploads to the $SPLUNK_HOME/var/run/splunk/apptemp directory, enabling remote code execution with a CVSS 3.1 score of 8.0.
A low-privileged Splunk user lacking the admin or power roles can exploit the issue over the network by uploading a malicious file that results in arbitrary code execution, granting the attacker high impact on confidentiality, integrity, and availability without requiring user interaction beyond the initial upload.
The official Splunk advisory SVD-2025-0301 recommends upgrading affected Enterprise and Cloud Platform instances to the fixed versions listed in the bulletin to remediate the missing authorization checks. The associated EPSS score has remained essentially flat near 0.11 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8549
Vulnerability details
In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.208, a low-privileged user that does not hold the "admin" or "power" Splunk roles could perform a Remote Code Execution (RCE)…
more
through a file upload to the "$SPLUNK_HOME/var/run/splunk/apptemp" directory due to missing authorization checks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE vulnerability in public-facing Splunk app due to missing authorization checks, allowing low-priv users to upload malicious files for arbitrary code execution, directly enabling T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources like the apptemp directory, directly addressing the missing authorization checks that allowed low-privileged users to upload malicious files.
Requires the system to explicitly authorize or deny access to specific resources such as $SPLUNK_HOME/var/run/splunk/apptemp, preventing unauthorized file uploads by low-privileged users.
Implements least privilege to ensure low-privileged users lack write access to sensitive directories like apptemp, mitigating exploitation even if authorization checks are incomplete.