PT-2025-40272 · Splunk · Splunk Cloud Platform+1

Eric Lamothe · Published 2025-10-01 · Updated 2025-10-01 · CVE-2025-20369

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.4.4 Splunk Enterprise versions 9.2.8 through 9.3.6 Splunk Cloud Platform versions prior to 9.3.2411.108 Splunk Cloud Platform versions 9.2.2406.123 through 9.3.2408.118

Description A user with limited privileges, lacking administrative or power roles within Splunk, may be able to inject XML external entities (XXE) through the dashboard tab label field. This XXE injection could potentially lead to denial of service (DoS) attacks. An XML external entity (XXE) injection is a web security issue that allows attackers to interfere with an application's processing of XML data.

Recommendations Update Splunk Enterprise to version 9.4.4 or later. Update Splunk Enterprise to version 9.3.6 or later. Update Splunk Enterprise to version 9.2.8 or later. Update Splunk Cloud Platform to version 9.3.2411.108 or later. Update Splunk Cloud Platform to version 9.3.2408.118 or later. Update Splunk Cloud Platform to version 9.2.2406.123 or later.

Fix

DoS

XML Entity Expansion

XXE

Weakness Enumeration

CWE-776

CWE-611

Related Identifiers

BDU:2025-13676

CVE-2025-20369

Affected Products

Splunk Cloud Platform

Splunk Enterprise

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-20369 · Security Note
• https://advisory.splunk.com/advisories/SVD-2025-1004 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13676 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20369 · Vendor Advisory
• https://twitter.com/CVEnew/status/1973429143258669544 · Twitter Post
• https://t.me/CVEtracker/33844 · Telegram Post