Listen to this Post
How the CVE Works
In Splunk Enterprise (versions below 9.4.2, 9.3.5, 9.2.6, 9.1.9) and Splunk Cloud Platform (versions below 9.3.2411.103, 9.3.2408.112, 9.2.2406.119), a low-privileged user with read-only access to a specific alert can suppress it when triggered. This occurs due to improper access controls in alert suppression groups, allowing unauthorized users to manipulate alert throttling settings. The flaw bypasses role-based restrictions, enabling unintended suppression of critical alerts without requiring admin or power roles.
DailyCVE Form
Platform: Splunk Enterprise/Cloud
Version: <9.4.2, <9.3.5, <9.2.6, <9.1.9
Vulnerability: Alert suppression bypass
Severity: Medium
Date: 07/07/2025
Prediction: Patch expected by 08/15/2025
What Undercode Say
Analytics:
splunk search "index=_internal source=splunkd.log suppressed_alert=" splunk btool check-suppression-group --debug
How Exploit:
- Attacker with read-only access modifies suppression rules.
- Alerts are silently throttled, evading detection.
Protection from this CVE:
- Upgrade to patched versions.
- Restrict alert suppression permissions.
Impact:
- Delayed incident response.
- Silent failure of monitoring.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
