← CVE Intelligence

CVE-2022-43570

XML External Entity Injection through a custom View in Splunk Enterprise PUBLISHED

Description (CNA)

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injection via a custom View. The XXE injection causes Splunk Web to embed incorrect documents into an error.

Affected (CNA)

Vendor / productVersions
Splunk / Splunk Enterpriseaffected 8.1 before 8.1.12; affected 8.2 before 8.2.9; affected 9.0 before 9.0.2

CWE

CWE-611

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.