Splunk Enterprise CVE-2025-20369

Exploitation requires an authenticated Splunk account on Splunk Enterprise (below 9.4.4, 9.3.6, 9.2.8, or 10.0.0) or Splunk Cloud Platform (below 9.3.2411.108, 9.3.2408.118, 9.2.2406.123); the account may be low-privilege and explicitly does NOT need the 'admin' or 'power' roles. The specific attack surface is the dashboard tab label field, which processes attacker-supplied XML and permits external entity injection. Limiting factors: valid credentials are mandatory (PR:L, so no unauthenticated access), there is no user-interaction requirement, and impact is confined to denial of service with no data exposure - reducing realistic risk to insiders or attackers who have already obtained a foothold account.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates network-reachable, low-complexity exploitation, but PR:L confirms an authenticated low-privilege Splunk account is required - the description clarifies this user need not hold the 'admin' or 'power' roles. Impact is limited strictly to availability (A:H) with no confidentiality or integrity loss, consistent with the described DoS-only outcome of the XXE. Exploitation-probability signals are low and mutually consistent: EPSS is only 0.06% (19th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided data. The combination of required authentication, DoS-only impact, and very low EPSS argues against this being a widely-weaponized target despite its network attack vector. The scored CVSS of 6.5 (Medium) aligns well with the vector and the authenticated/availability-only nature of the flaw; no key signals conflict. The main caveat is that this requires an attacker to already possess valid (even if low-privilege) Splunk credentials, which materially narrows the realistic threat to insiders or post-compromise scenarios.

An authenticated low-privilege Splunk user (without admin or power roles) submits a dashboard containing a crafted XML external entity payload in the dashboard tab label field. The XXE triggers resource exhaustion or entity-expansion processing that degrades or denies service to the Splunk instance. No public exploit code was identified at time of analysis, and the low attack complexity means exploitation is straightforward once valid credentials are held.