vulnerability

Splunk: CVE-2022-43569: Persistent Cross-Site Scripting via a Data Model object name in Splunk Enterprise

Severity
9
CVSS
(AV:N/AC:M/Au:S/C:C/I:C/A:C)
Published
Nov 2, 2022
Added
Apr 7, 2025
Modified
Mar 25, 2026

Description

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of a Data Model.

Solution

splunk-upgrade-latest
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.