CVE-2025-20227

{"id": "CVE-2025-20227", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-03-26T22:15:14.637", "references": [{"url": "https://advisory.splunk.com/advisories/SVD-2025-0306", "source": "psirt@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 and 9.1.2308.214, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could bypass the external content warning modal dialog box in Dashboard Studio dashboards which could lead to an information disclosure."}, {"lang": "es", "value": "En las versiones de Splunk Enterprise anteriores a 9.4.1, 9.3.3, 9.2.5 y 9.1.8, y en las versiones de Splunk Cloud Platform anteriores a 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312.208 y 9.1.2308.214, un usuario con privilegios bajos que no tenga los roles de \"administrador\" o \"poder\" de Splunk podr\u00eda omitir el cuadro de di\u00e1logo modal de advertencia de contenido externo en los paneles de Dashboard Studio, lo que podr\u00eda provocar una divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2025-03-27T16:45:27.850", "sourceIdentifier": "psirt@cisco.com"}