CVE-2025-20373
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-11-26
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| splunk | splunk_add-on_for_palo_alto_networks | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
In Splunk Add-on for Palo Alto Networks versions below 2.0.2, client secrets are exposed in plain text within the _internal index when adding new Data Security Accounts. This exposure requires either local access to log files or administrative access to internal indexes, which are typically restricted to admin roles.
How can this vulnerability impact me? :
If an attacker gains local access to log files or administrative access to internal indexes, they could obtain client secrets in plain text. This could lead to unauthorized access or misuse of those secrets, potentially compromising security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reviewing the _internal index logs in Splunk for exposed client secrets related to the addition of new Data Security Accounts. Since the issue involves client secrets being stored in plain text in the _internal index, you can search the internal logs for sensitive information patterns. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include reviewing roles and capabilities on your Splunk instance and restricting access to the _internal index to administrator-level roles only. Ensure that only trusted admin roles have access to internal indexes to prevent exposure of client secrets. Additionally, upgrade the Splunk Add-on for Palo Alto Networks to version 2.0.2 or later where this vulnerability is fixed.