Splunk XXE Injection Vulnerability in Dashboard Labels Allowing Denial-of-Service

A vulnerability allowing XML external entity (XXE) injection has been identified in Splunk Enterprise versions prior to 9.4.4, 9.3.6, and 9.2.8, as well as in Splunk Cloud Platform versions prior to 9.3.2411.108, 9.3.2408.118, and 9.2.2406.123. This vulnerability allows low privilege users, who do not have 'admin' or 'power' roles, to inject malicious XML that could be exploited to perform denial-of-service attacks.

Impact

Exploitation of this vulnerability could lead to denial-of-service conditions, causing Splunk to become unresponsive or unavailable.

Remediation

Users of Splunk Enterprise should upgrade to versions 9.4.4, 9.3.6, or 9.2.8. For Splunk Cloud Platform users, no action is needed as Splunk is actively monitoring and patching instances. Additionally, turning off Splunk Web can mitigate the vulnerability.