CVE-2022-32154

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will.

• CVE ID
• CVE-2022-32154

• Assigner
• prodsec@splunk.com

• Vulnerability Status
• Analyzed

• Published Version
• 2022-06-15T17:15:09

• Last Modified Date
• 2022-06-24T01:22:06

• Version
• 2.0

• Vector String
• AV:N/AC:H/Au:N/C:P/I:P/A:N

• Access Vector
• NETWORK

• Access Compatibility
• HIGH

• Authentication
• NONE

• Confidentiality Impact
• PARTIAL

• Integrity Impact
• PARTIAL

• Availability Impact
• NONE

• Base Score
• 4

• Severity
• MEDIUM

• Exploitability Score
• 4.9

• Impact Score
• 4.9

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

• Attack Vector
• NETWORK

• Attack Compatibility
• LOW

• Privileges Required
• NONE

• User Interaction
• REQUIRED

• Scope
• UNCHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• NONE

• Base Score
• 8.1

• Base Severity
• HIGH

• Exploitability Score
• 2.8

• Impact Score
• 5.2