SecuriTricks - CVE-2025-20389

Description

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `label` column field after adding a new device in the Splunk Secure Gateway app. This could potentially lead to a client-side denial of service (DoS).

Product(s) Impacted

Vendor	Product	Versions
Splunk	Splunk Enterprise Splunk Secure Gateway App	<10.0.2 <3.9.10

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	splunk	splunk_enterprise	<10.0.2	/	/	/	/	/	/	/
a	splunk	splunk_secure_gateway_app	<3.9.10	/	/	/	/	/	/	/

References

https://advisory.splunk.com/advisories/SVD-2025-1208

CVSS Score

4.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

View Vector String

Timeline

Published: Dec. 3, 2025, 5:15 p.m.
Last Modified: Dec. 4, 2025, 5:15 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@cisco.com

CVE-2025-20389