CVEvulnerability

CVE-2025-20387

6.5 MEDIUM Published 2025-12-03 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-12-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-732

Description

In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory. This lets non-administrator users on the machine access the directory and all its contents.

Affected configurations

• splunk splunk (>= 9.2.0 < 9.2.10) • splunk splunk (>= 9.3.0 < 9.3.8) • splunk splunk (>= 9.4.0 < 9.4.6) • splunk splunk (>= 10.0.0 < 10.0.2)

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References