CVE-2025-20369: splunk XML Entity Expansion

Vulnerability summary

CVE-2025-20369 is a medium (CVSS 6.5) XML Entity Expansion vulnerability in splunk. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.8% of scored vulnerabilities.

Timeline

1. 01-10-2025
   PublishedVulnerability first disclosed.
2. 01-10-2025
   Last modifiedVulnerability information updated.

Description

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.

• CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.