CVE-2022-43567: splunk Deserialization of Untrusted Data
CVSS: 8.8v3.1HighModified
Published 04-11-2022Last modified 05-05-2025
Vulnerability summary
CVE-2022-43567 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in splunk. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 70% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
1.30%
0%100%
Low · +0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 04-11-2022PublishedVulnerability first disclosed.
- 05-05-2025Last modifiedVulnerability information updated.
Description
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.30%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
+0.05 pp
From 1.25% on 19-09-2026
19-09-202619-10-2026
EPSS score1.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (research.splunk.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Splunk3 products
- splunk≥ 8.1.0, < 8.1.12 | ≥ 8.2.0, < 8.2.9 | ≥ 9.0.0, < 9.0.2
- splunk_cloud_platform< 9.0.2205
- splunk enterprise≥ 8.1, < 8.1.12 | ≥ 8.2, < 8.2.9 | ≥ 9.0, < 9.0.2
1 vendor · 3 products