6.5

CVE-2025-20389

Medienbericht

Improper Input Validation in "label" column field in Splunk Secure Gateway App

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `label` column field after adding a new device in the Splunk Secure Gateway app. This could potentially lead to a client-side denial of service (DoS).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Splunk ≫ Splunk SwEdition enterprise Version >= 9.2.0 < 9.2.10
Splunk ≫ Splunk SwEdition enterprise Version >= 9.3.0 < 9.3.8
Splunk ≫ Splunk SwEdition enterprise Version >= 9.4.0 < 9.4.6
Splunk ≫ Splunk SwEdition enterprise Version >= 10.0.0 < 10.0.2
Splunk ≫ Splunk Cloud Platform Version >= 9.3.2411 < 9.3.2411.120
Splunk ≫ Splunk Cloud Platform Version >= 10.0.2503 < 10.0.2503.8
Splunk ≫ Splunk Cloud Platform Version >= 10.1.2507 < 10.1.2507.6
Splunk ≫ Splunk Secure Gateway Version >= 3.7.0 < 3.7.28
Splunk ≫ Splunk Secure Gateway Version >= 3.8.0 < 3.8.58
Splunk ≫ Splunk Secure Gateway Version >= 3.9.0 < 3.9.10
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.333
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Cisco PSIRT 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
05.12.2025 11:44
https://advisory.splunk.com/advisories/SVD-2025-1208
Vendor Advisory