Product:
Splunk Enterprise
Summary
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, as well as versions below 3.9.10, 3.8.58, and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user could craft a malicious payload through the label column field after adding a new device. This could potentially lead to a client-side denial of service.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-20389 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can add a new device in the Splunk Secure Gateway app and manipulate the label column field to create a malicious payload. This crafted payload can then trigger a denial of service condition on the client side, affecting the availability of the application.
Affected Products
- Splunk Enterprise versions below 10.0.2
- Splunk Enterprise versions below 9.4.6
- Splunk Enterprise versions below 9.3.8
- Splunk Enterprise versions below 9.2.10
- Splunk Secure Gateway app versions below 3.9.10
- Splunk Secure Gateway app versions below 3.8.58
- Splunk Secure Gateway app versions below 3.7.28
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Splunk Enterprise and the Splunk Secure Gateway app. Ensuring that users have appropriate role permissions can also help prevent exploitation by low-privileged users.