In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards in the Analytics Workspace. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
References
| Link | Resource |
|---|---|
| https://research.splunk.com/application/b6d77c6c-f011-4b03-8650-8f10edb7c4a8/ | Exploit Vendor Advisory |
| https://www.splunk.com/en_us/product-security/announcements/svd-2022-1106.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:53
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards in the Analytics Workspace. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will. |
27 Jun 2023, 02:44
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 |
Information
Published : 2022-11-04 23:15
Updated : 2024-02-28 19:29
NVD link : CVE-2022-43566
Mitre link : CVE-2022-43566
CVE.ORG link : CVE-2022-43566
JSON object : View
Products Affected
splunk
- splunk_cloud_platform
- splunk
CWE
CWE-20
Improper Input Validation