Inclusion of Sensitive Information in Log Files in Splunk Enterprise and Splunk Secure Gateway - CVE-2025-20231
Published: March 26, 2025
Vulnerability identifier: #VU106068
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-20231
CWE-ID: CWE-532
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to the Splunk Secure Gateway exposes user session and authorization tokens in clear text in the splunk_secure_gateway.log file when it calls the /services/ssg/secrets REST endpoint. A remote unprivileged user can gain access to authorization tokens and use them to compromise the affected system.
Affected software
Splunk Enterprise
Splunk Secure Gateway
Splunk Secure Gateway
How to mitigate CVE-2025-20231
Install updates from vendor's website.
Splunk Enterprise - addressed in versions 9.1.8, 9.2.5, 9.3.3, 9.4.1
Splunk Secure Gateway - addressed in versions 3.7.23, 3.8.38
Splunk Secure Gateway - addressed in versions 3.7.23, 3.8.38