CVE-2022-43568 HIGH

CVE-2022-43568: Reflected Cross-Site Scripting via the radio template in Splunk Enterprise

Vendor Splunk
Product Splunk Enterprise
Weakness CWE-79 · XSS
Published November 4, 2022
Last update May 1, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio.

Key dates

02Disclosure timeline

November 4, 2022 CVE published
May 1, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-6461 Cross-site Scripting (XSS) - Reflected in viliusle/minipaint CVE-2024-28175 Cross-site scripting on application summary component in argo-cd CVE-2024-53757 WordPress WP Find Your Nearest plugin <= 0.3.1 - Cross Site Scripting (XSS) vulnerability CVE-2025-2715 timschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scripting CVE-2024-37554 WordPress UltraAddons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability