The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-1001 advisory.

  - In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below     9.3.2411.111, 9.3.2408.119, and 9.2.2406.122, a low-privileged user that does not hold the admin or power     Splunk roles could access sensitive search results if Splunk Enterprise runs an administrative search job     in the background. If the low privileged user guesses the search job's unique Search ID (SID), the user     could retrieve the results of that job, potentially exposing sensitive search results. For more     information see https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-jobs/about-     jobs-and-job-management and https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.0/manage-     jobs/manage-search-jobs. (CVE-2025-20366)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Splunk Enterprise 9.2.0 < 9.2.8, 9.3.0 < 9.3.6, 9.4.0 < 9.4.4 (SVD-2025-1001)

medium Nessus Plugin ID 266443

Version 1.1