Lucene search
SplunkCVELIST:CVE-2022-43569HistoryNov 04, 2022 - 10:22 p.m.
CVE-2022-43569 Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise
2022-11-0422:22:31
CWE-79
Splunk
www.cve.org
3
splunk
cross-site scripting
data model
CVSS3
8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
AI Score
7.3
Confidence
High
EPSS
0.001
Percentile
24.8%
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of a Data Model.
CNA Affected
[
{
"defaultStatus": "affected",
"product": "Splunk Enterprise",
"vendor": "Splunk",
"versions": [
{
"lessThan": "8.1.12",
"status": "affected",
"version": "8.1",
"versionType": "custom"
},
{
"lessThan": "8.2.9",
"status": "affected",
"version": "8.2",
"versionType": "custom"
},
{
"lessThan": "9.0.2",
"status": "affected",
"version": "9.0",
"versionType": "custom"
}
]
}
]Related
nvd
nvd
CVE-2022-43569
2022-11-04 23:15:10
prion
prion
Cross site scripting
2022-11-04 23:15:00
nessus
nessus
Splunk Enterprise 8.1 < 8.1.12, 8.2.0 < 8.2.9, 9.0.0 < 9.0.2 (SVD-2022-1109)
2022-11-03 00:00:00
cve
cve
CVE-2022-43569
2022-11-04 23:15:10
CVSS3
8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
AI Score
7.3
Confidence
High
EPSS
0.001
Percentile
24.8%
Related for CVELIST:CVE-2022-43569