CVEvulnerability

CVE-2025-20369

6.5 MEDIUM Published 2025-10-01 Modified 2026-10-18 Official page ↗
Status
Analyzed
Published
2025-10-01
Last modified
2026-10-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-611, CWE-776

Description

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.

Affected configurations

• splunk splunk (>= 9.2.0 < 9.2.8) • splunk splunk (>= 9.3.0 < 9.3.6) • splunk splunk (>= 9.4.0 < 9.4.4) • splunk splunk cloud platform (>= 9.2.2406 < 9.2.2406.123) • splunk splunk cloud platform (>= 9.3.2408 < 9.3.2408.118) • splunk splunk cloud platform (>= 9.3.2411 < 9.3.2411.108)

Related

Weakness · CWE (2)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References