CVE-2022-43571

Remote Code Execution through dashboard PDF generation component in Splunk Enterprise

In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component.

Affected

Splunk · Splunk Enterprise

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

14.06% chance of exploitation in the next 30 days, 97th percentile

Published

2022-11-03

Updated

2025-05-02

Proof-of-concept exploits (1)

• ohnonoyesyes/CVE-2022-435710★ · 2022-12-27

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/splunk_auth_rce_cve_2…

Security advisories

• https://research.splunk.com/application/b06b41d7-9570-4985-8137-0784f582a1b3
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-1111.html

References

• CVE Record
• NVD entry

Related

• CVE-2022-41080
• CVE-2022-41082
• CVE-2022-47986
• CVE-2023-1671
• CVE-2023-21742
• CVE-2023-25194