CVE-2022-43562 — Host Header Injection in Splunk Enterprise

CVE-2022-43562

Host Header Injection in Splunk Enterprise PUBLISHED

Description (CNA)

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote authenticated user conduct various attacks against the system, including cross-site scripting and cache poisoning.

Affected (CNA)

Vendor / product	Versions
Splunk / Splunk Enterprise	affected 8.1 before 8.1.12; affected 8.2 before 8.2.9; affected 9.0 before 9.0.2

CWE

CWE-20

References

https://www.splunk.com/en_us/product-security/announcements/svd-2022-1102.html

ADP enrichment

CVE

No English description supplied.

https://www.splunk.com/en_us/product-security/announcements/svd-2022-1102.html

CISA-ADP

No English description supplied.

No references supplied.