Listen to this Post
How the CVE Works
CVE-2025-20323 affects Splunk Enterprise versions prior to 9.4.3, 9.3.5, 9.2.7, and 9.1.10. The vulnerability arises due to insufficient access controls in the Splunk Archiver application. A low-privileged user without “admin” or “power” roles can disable the scheduled search Bucket Copy Trigger. This occurs because the saved searches in the Archiver app do not enforce proper role-based restrictions. The flaw allows unauthorized manipulation of critical archiving tasks, potentially disrupting log management workflows.
DailyCVE Form
Platform: Splunk Enterprise
Version: <9.4.3, <9.3.5, <9.2.7, <9.1.10
Vulnerability: Missing Access Controls
Severity: Low
Date: 07/07/2025
Prediction: Patch by 08/15/2025
What Undercode Say
splunk search "| rest /servicesNS/-/archiver/saved/searches"
if user.role not in ["admin", "power"]: deny_search_edit()
How Exploit
1. Authenticate as low-privileged user.
2. Navigate to Archiver app.
3. Disable `Bucket Copy Trigger`.
Protection from this CVE
- Upgrade to Splunk 9.4.3+.
- Restrict Archiver app access.
- Audit saved searches permissions.
Impact
- Disrupted log archiving.
- Unauthorized configuration changes.
- Minimal data integrity risk.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
