CVE-2025-0367 MEDIUM

CVE-2025-0367: Regular Expression Denial of Service (ReDoS) in Splunk Supporting Add-on for Active Directory (SA-ldapsearch)

Vendor Splunk
Product Splunk Supporting Add-on for Active Directory
Weakness CWE-1333
Published January 30, 2025
Last update February 12, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could lead to a Regular Expression Denial of Service (ReDoS) attack.

Key dates

02Disclosure timeline

January 30, 2025 CVE published
February 12, 2025 Record updated