vulnerability
Splunk: CVE-2025-20369: Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:M/Au:S/C:N/I:P/A:P) | Oct 1, 2025 | Oct 6, 2025 | Oct 31, 2025 |
Severity
5
CVSS
(AV:N/AC:M/Au:S/C:N/I:P/A:P)
Published
Oct 1, 2025
Added
Oct 6, 2025
Modified
Oct 31, 2025
Description
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the ‘admin’ or ‘power’ Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.
Solution
splunk-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.