CVE-2022-43563 is a high-severity vulnerability affecting Splunk Enterprise versions below 8.2.9 and 8.1.12, where a flaw in the 'rex' search command's handling of field names allows attackers to bypass SPL safeguards. This vulnerability has a CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability, and requires user interaction (phishing) for exploitation. While no public exploit code or active exploitation has been observed, its high FAUCET Risk Score of 68/100 and notable media coverage suggest its potential significance. Community discussion is limited, and it is not listed in CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.1.0, < 8.1.12CPE matchmatch criteria | cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* | ||
>= 8.2.0, < 8.2.9CPE matchmatch criteria | cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* | ||
< 9.0.2203CPE matchmatch criteria | cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:* | ||
>= 8.1, < 8.1.12CPE match | cpe:2.3:a:splunk:splunk:*:*:*:*:*:*:*:* | ||
>= 8.2, < 8.2.9CPE match | cpe:2.3:a:splunk:splunk:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.