CVE-2025-20369: splunk XXE — Fix

Description

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.

Is your site exposed to CVE-2025-20369?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.6

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Weakness Type (CWE)

CWE-776 CWE-776

CWE-611 CWE-611

Affected Products

Vendor	Product	Versions
splunk	splunk	9.2.0 — 9.2.8
splunk	splunk	9.3.0 — 9.3.6
splunk	splunk	9.4.0 — 9.4.4
splunk	splunk_cloud_platform	9.2.2406 — 9.2.2406.123
splunk	splunk_cloud_platform	9.3.2408 — 9.3.2408.118
splunk	splunk_cloud_platform	9.3.2411 — 9.3.2411.108

References

Advisories & Patches

https://advisory.splunk.com/advisories/SVD-2025-1004

Frequently Asked Questions

What is CVE-2025-20369? +

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks. It has a CVSS v3.1 base score of 4.6 (MEDIUM).

How severe is CVE-2025-20369? +

CVE-2025-20369 has a CVSS v3.1 score of 4.6 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-20369? +

CVE-2025-20369 affects products from splunk, specifically: splunk, splunk_cloud_platform. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-20369? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-42212

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a …

CVE-2019-19144 9.8

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.

CVE-2026-45771 7.5

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that …

CVE-2026-31248 7.5

Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML …

CVE-2025-3225 7.5

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index …

CVE-2026-44020 7.5

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, …

CVE-2025-20369