CVE-2022-26889

 

Published at: - 06-05-2022 07:15

Last modified: - 19-10-2022 05:35

Total changes: - 5

Description

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to initiate a request within the victim's browser (e.g., phishing).

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0506.html
• https://research.splunk.com/application/path_traversal_spl_injection/

 

Keywords

NVD

 

CVE-2022-26889

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures