CVE-2022-43562CWE-20

Host Header Injection in Splunk Enterprise

Low · published November 4, 2022

CVSS v3.1
3.0
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and cache poisoning.

The record
Technical detail
CVSS v3.1
3.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00464 · 39.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2022-11-04T22:19Z
EPSS history
Timeline
  • 04 NOV 22:19Z
    Host Header Injection in Splunk Enterprise
    cvelistv5