CVE-2022-43571CWE-94

Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

High · published November 3, 2022

CVSS v3.1

8.8

EPSS

14%

Percentile

96.6

In the wild

Unconfirmed

What it is

In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.14062 · 96.6th percentile
Weakness: CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2022-11-03T22:56Z

EPSS history

Timeline

03 NOV 22:56Z
Remote Code Execution through dashboard PDF generation component in Splunk Enterprise
cvelistv5