Vulnerability · Published Nov 3, 2022 · Assigned by Splunk
CVE-2022-43571Remote Code Execution through dashboard PDF generation component in Splunk Enterprise
High 8.8
In plain English
A high-severity code injection in Splunk Enterprise from Splunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 18.6% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)18.6%top 2.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Metasploit, Public PoC
Official description
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk | Splunk Enterprise | 8.1 – before 8.1.128.2 – before 8.2.99.0 – before 9.0.2 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H