CVE-2025-20369
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-01 17:15:40.080000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-20369",
"sourceIdentifier": "[email protected]",
"published": "2025-10-01T17:15:40.080",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the \"admin\" or \"power\" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks."
},
{
"lang": "es",
"value": "En las versiones de Splunk Enterprise anteriores a 9.4.4, 9.3.6 y 9.2.8, y en las versiones de Splunk Cloud Platform anteriores a 9.3.2411.108, 9.3.2408.118 y 9.2.2406.123, un usuario con privilegios bajos que no posee los roles de Splunk 'admin' o 'power' podría realizar una inyección de entidad externa (XXE) de lenguaje de marcado extensible (XML) a través del campo de etiqueta de pestaña del panel. La inyección XXE tiene el potencial de causar ataques de denegación de servicio (DoS)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"versions": [
{
"version": "10.0",
"lessThan": "10.0.0",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.4",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3",
"lessThan": "9.3.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.2",
"lessThan": "9.2.8",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Cloud Platform",
"versions": [
{
"version": "9.3.2411",
"lessThan": "9.3.2411.108",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3.2408",
"lessThan": "9.3.2408.118",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.2.2406",
"lessThan": "9.2.2406.123",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.1,
"impactScore": 2.5
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-01T17:22:49.875195Z",
"id": "CVE-2025-20369",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-776"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-611"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.2.0",
"versionEndExcluding": "9.2.8",
"matchCriteriaId": "724443E6-2DC9-4AB3-8E8F-D9BFBCC162E6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.3.0",
"versionEndExcluding": "9.3.6",
"matchCriteriaId": "046659D8-1F48-4229-AC57-2A3B77D44442"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.4",
"matchCriteriaId": "88D2F283-10F9-4204-876A-9BEE75130E2C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.2.2406",
"versionEndExcluding": "9.2.2406.123",
"matchCriteriaId": "4F61F654-CFCC-4E48-A860-7AFCBBE69297"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.3.2408",
"versionEndExcluding": "9.3.2408.118",
"matchCriteriaId": "D49A3BA2-2260-4294-964A-8E8A3729CEB4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.3.2411",
"versionEndExcluding": "9.3.2411.108",
"matchCriteriaId": "D7F27B31-B360-4AC9-BBBC-0A0F720C0B59"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2025-1004",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}