CVEvulnerability

CVE-2025-20298

8.0 HIGH Published 2025-06-02 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-06-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-732

Description

In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwarder). This lets non-administrator users on the machine access the directory and all its contents.

Affected configurations

• splunk universal forwarder (>= 9.1.0 < 9.1.9) • splunk universal forwarder (>= 9.2.0 < 9.2.6) • splunk universal forwarder (>= 9.3.0 < 9.3.4) • splunk universal forwarder (>= 9.4.0 < 9.4.2)

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References