{"id":"CVE-2025-20227","state":"PUBLISHED","title":"Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio","description":"In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure.","publishedAt":"2025-03-26T22:03:50.424Z","updatedAt":"2025-03-27T13:50:15.585Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"cisco"},"assigner":"cisco","products":["Splunk Splunk Enterprise","Splunk Splunk Cloud Platform"],"affected":[{"vendor":"Splunk","product":"Splunk Enterprise","versions":[{"version":"9.4","status":"affected","lessThan":"9.4.1","versionType":"custom"},{"version":"9.3","status":"affected","lessThan":"9.3.3","versionType":"custom"},{"version":"9.2","status":"affected","lessThan":"9.2.5","versionType":"custom"},{"version":"9.1","status":"affected","lessThan":"9.1.8","versionType":"custom"}]},{"vendor":"Splunk","product":"Splunk Cloud Platform","versions":[{"version":"9.3.2408","status":"affected","lessThan":"9.3.2408.107","versionType":"custom"},{"version":"9.2.2406","status":"affected","lessThan":"9.2.2406.113","versionType":"custom"},{"version":"9.2.2403","status":"affected","lessThan":"9.2.2403.115","versionType":"custom"},{"version":"9.1.2312","status":"affected","lessThan":"9.1.2312.208","versionType":"custom"},{"version":"9.1.2308","status":"affected","lessThan":"9.1.2308.214","versionType":"custom"}]}],"references":["https://advisory.splunk.com/advisories/SVD-2025-0306"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/20xxx/CVE-2025-20227.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-20227","state":"PUBLISHED","datePublished":"2025-03-26T22:03:50.424Z","dateUpdated":"2025-03-27T13:50:15.585Z","assignerShortName":"cisco","assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateReserved":"2024-10-10T19:15:13.236Z"},"containers":{"cna":{"title":"Information Disclosure through external content warning modal dialog box bypass in Splunk Enterprise Dashboard Studio","descriptions":[{"lang":"en","value":"In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure."}],"affected":[{"vendor":"Splunk","product":"Splunk Enterprise","versions":[{"version":"9.4","status":"affected","lessThan":"9.4.1","versionType":"custom"},{"version":"9.3","status":"affected","lessThan":"9.3.3","versionType":"custom"},{"version":"9.2","status":"affected","lessThan":"9.2.5","versionType":"custom"},{"version":"9.1","status":"affected","lessThan":"9.1.8","versionType":"custom"}]},{"vendor":"Splunk","product":"Splunk Cloud Platform","versions":[{"version":"9.3.2408","status":"affected","lessThan":"9.3.2408.107","versionType":"custom"},{"version":"9.2.2406","status":"affected","lessThan":"9.2.2406.113","versionType":"custom"},{"version":"9.2.2403","status":"affected","lessThan":"9.2.2403.115","versionType":"custom"},{"version":"9.1.2312","status":"affected","lessThan":"9.1.2312.208","versionType":"custom"},{"version":"9.1.2308","status":"affected","lessThan":"9.1.2308.214","versionType":"custom"}]}],"references":[{"url":"https://advisory.splunk.com/advisories/SVD-2025-0306"}],"metrics":[{"cvssV3_1":{"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","lang":"en","type":"cwe","description":"The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program."}]}],"providerMetadata":{"shortName":"cisco","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","dateUpdated":"2025-03-26T22:03:50.424Z"},"datePublic":"2025-03-26T00:00:00.000Z","source":{"advisory":"SVD-2025-0306"},"credits":[{"lang":"en","value":"Taihei Shimamine"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-27T13:50:08.258188Z","id":"CVE-2025-20227","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-27T13:50:15.585Z"}}]}}}