Vulnerability Description
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `label` column field after adding a new device in the Splunk Secure Gateway app. This could potentially lead to a client-side denial of service (DoS).
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk | >= 9.2.0, < 9.2.10 |
| Splunk | Splunk Cloud Platform | >= 9.3.2411, < 9.3.2411.120 |
| Splunk | Splunk Secure Gateway | >= 3.7.0, < 3.7.28 |
Related Weaknesses (CWE)
References
- https://advisory.splunk.com/advisories/SVD-2025-1208Vendor Advisory
FAQ
What is CVE-2025-20389?
CVE-2025-20389 is a vulnerability with a CVSS score of 4.3 (MEDIUM). In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that...
How severe is CVE-2025-20389?
CVE-2025-20389 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-20389?
Check the references section above for vendor advisories and patch information. Affected products include: Splunk Splunk, Splunk Splunk Cloud Platform, Splunk Splunk Secure Gateway.