Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the admin or power Splunk roles could perform an XML external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.6 | CVE-2025-20369 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can craft a malicious XML payload and inject it through the dashboard tab label field. This action can lead to unauthorized access to sensitive data or cause a denial of service by overwhelming the system with requests.
Affected Products
- Splunk Enterprise versions below 9.4.4
- Splunk Enterprise versions below 9.3.6
- Splunk Enterprise versions below 9.2.8
- Splunk Cloud Platform versions below 9.3.2411.108
- Splunk Cloud Platform versions below 9.3.2408.118
- Splunk Cloud Platform versions below 9.2.2406.123
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and Splunk Cloud Platform. Additionally, restricting access to the dashboard tab label field for low privilege users can help prevent exploitation.