Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Splunk | Splunk Enterprise | affected |
|
|||||||||||||||
| Splunk | Splunk Cloud Platform | affected |
|
|||||||||||||||
| Splunk | Splunk Secure Gateway | affected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Splunk | Splunk Cloud Platform | — | — |
| Splunk | Splunk Enterprise | — | — |
| Splunk | Splunk Secure Gateway | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://advisory.splunk.com/advisories/SVD-2025-1208 |
|
Fri, 05 Dec 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Splunk splunk
|
|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:* cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:* |
|
| Vendors & Products |
Splunk splunk
|
Thu, 04 Dec 2025 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Splunk
Splunk splunk Cloud Platform Splunk splunk Enterprise Splunk splunk Secure Gateway |
|
| Vendors & Products |
Splunk
Splunk splunk Cloud Platform Splunk splunk Enterprise Splunk splunk Secure Gateway |
Wed, 03 Dec 2025 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 03 Dec 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of the Splunk Secure Gateway app on Splunk Cloud Platform, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious payload through the `label` column field after adding a new device in the Splunk Secure Gateway app. This could potentially lead to a client-side denial of service (DoS). | |
| Title | Improper Input Validation in "label" column field in Splunk Secure Gateway App | |
| Weaknesses | CWE-20 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published:
Updated: 2025-12-03T21:37:01.207Z
Reserved: 2024-10-10T19:15:13.266Z
Link: CVE-2025-20389
Vulnrichment
Updated: 2025-12-03T21:36:54.207Z
NVD
Status : Analyzed
Published: 2025-12-03T17:15:51.610
Modified: 2025-12-05T17:05:57.880
Link: CVE-2025-20389
Redhat
No data.
OpenCVE Enrichment
Updated: 2025-12-04T16:44:21Z