PT-2022-26970 · Splunk · Splunk Secure Gateway App+1

Danylo Dmytriiev + 1 · Published 2022-11-04 · Updated 2023-07-06 · CVE-2022-43567

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.2.9 Splunk Enterprise versions prior to 8.1.12 Splunk Enterprise versions prior to 9.0.2

Description The issue allows an authenticated user to run arbitrary operating system commands remotely through specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.

Recommendations For versions prior to 8.2.9, update to version 8.2.9 or later. For versions prior to 8.1.12, update to version 8.1.12 or later. For versions prior to 9.0.2, update to version 9.0.2 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-43567

Affected Products

Splunk Enterprise

Splunk Secure Gateway App

References · 5

• 🔥 https://research.splunk.com/application/baa41f09-df48-4375-8991-520beea161be · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-43567 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43567 · Vendor Advisory
• https://splunk.com/en_us/product-security/announcements/svd-2022-1107.html · Vendor Advisory
• https://t.me/cvenotify/37102 · Telegram Post