CVE-2025-20369CWE-611CWE-776xxe

CVE-2025-20369

Medium · published October 1, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
22.8
In the wild
Unconfirmed
What it is

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00311 · 22.8th percentile
Weaknesses
CWE-611 · Improper Restriction of XML External Entity Reference; CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Published
2025-10-01T21:15Z
Affected products (6)
ProductVersionsFixed in
splunk/splunk≥ 9.2.0, < 9.2.89.2.8
splunk/splunk≥ 9.3.0, < 9.3.69.3.6
splunk/splunk≥ 9.4.0, < 9.4.49.4.4
splunk/splunk_cloud_platform≥ 9.2.2406, < 9.2.2406.1239.2.2406.123
splunk/splunk_cloud_platform≥ 9.3.2408, < 9.3.2408.1189.3.2408.118
splunk/splunk_cloud_platform≥ 9.3.2411, < 9.3.2411.1089.3.2411.108
References (1)
https://advisory.splunk.com/advisories/SVD-2025-1004 · [email protected]
EPSS history
Timeline
  • 01 OCT 16:07Z
    Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise
    cvelistv5