Listen to this Post
In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Secure Gateway app versions below 3.9.10, 3.8.58, and 3.7.28, a low-privileged user lacking “admin” or “power” roles can exploit a vulnerability by crafting a malicious payload in the `label` column field when adding a new device through the Splunk Secure Gateway app. This vulnerability arises from insufficient input sanitization in the web interface, allowing the injection of harmful code that executes on the client side. The attack requires network access and low privileges, with no user interaction needed, leading to a client-side denial of service (DoS) by disrupting the user interface or client functionality. The CVSS 3.1 score is 4.3 (MEDIUM), reflecting a moderate impact on availability due to the low attack complexity and limited scope to client-side disruptions.
Platform: Splunk Enterprise
Version: Versions below 10.0.2
Vulnerability: Client-side DoS
Severity: Medium
Date: 12/03/2025
Prediction: Fixed in 10.0.2
What Undercode Say:
Showing bash commands and codes related to the blog
`splunk version`
`splunk list app`
`check app version`
how Exploit:
Malicious label payload
Low-privileged user access
Client-side DoS triggered
Protection from this CVE:
Upgrade to 10.0.2
Update Secure Gateway
Apply security patches
Impact:
Client-side disruption
Low availability impact
Medium severity score
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
