High severity · published Nov 4, 2022
CVE-2022-43565
Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Splunk Enterprise · Splunk
8.1 before 8.1.12; 8.2 before 8.2.9 · source: vendor
SP
Splunk · Splunk
8.1.0 before 8.1.12; 8.2.0 before 8.2.9 · source: NVD
SC
Splunk Cloud Platform · Splunk
before 9.0.2203 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43565
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43565
Vendor Advisory
https://www.splunk.com/en_us/product-security/announcements/svd-2022-1105.html
More from Splunk Enterprise
9.8
CVE-2026-20253
Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
9.9
CVE-2026-76302
Security Hardening in Splunk Enterprise - October 2026
9.9
CVE-2026-76299
Security Hardening in Splunk Enterprise - October 2026
9.8
CVE-2026-76301
Security Hardening in Splunk Enterprise - October 2026
9.8
CVE-2026-76285
Improper Adherence to Coding Standards in Splunk Enterprise