CVE-2022-27183CWE-79

Reflected XSS in a query parameter of the Monitoring Console

High · published May 6, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platform instances. Note that the Cloud Monitoring Console is not impacted.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-05-06T16:38Z
EPSS history
Timeline
  • 06 MAY 16:38Z
    Reflected XSS in a query parameter of the Monitoring Console
    cvelistv5