CVE-2022-43568CWE-79

Reflected Cross-Site Scripting via the radio template in Splunk Enterprise

High · published November 4, 2022

CVSS v3.1

8.8

EPSS

43%

Percentile

98.7

In the wild

Unconfirmed

What it is

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.42801 · 98.7th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2022-11-04T22:22Z

EPSS history

Timeline

04 NOV 22:22Z
Reflected Cross-Site Scripting via the radio template in Splunk Enterprise
cvelistv5