Security readout for executives and security teams
Plain-English summary
This flaw lets a phished user’s browser help bypass Splunk protections around risky SPL commands. It affects older Splunk Enterprise 8.1 and 8.2 releases. The attacker needs user interaction and cannot trigger it at will, but successful abuse could expose or alter high-value Splunk data.
Executive priority
Treat this as a high-priority Splunk maintenance item where affected versions remain in service. The business risk is concentrated around privileged security data access, but exploitation depends on user interaction rather than unauthenticated direct compromise.
Technical view
CVE-2022-43563 is a CWE-20 input validation issue in how Splunk Enterprise’s rex search command handles field names. In affected versions, that handling can bypass SPL safeguards for risky commands. The CVSS 3.1 score is 8.1, with high confidentiality and integrity impact and required user interaction.
Likely exposure
Exposure is limited to Splunk Enterprise 8.1 and 8.2 installations below 8.1.12 and 8.2.9. Systems used by administrators or analysts through browsers are the practical concern, especially where users can be phished into opening crafted requests.
Exploitation context
The source bundle says exploitation requires phishing a victim into initiating a browser request. It also says the attacker cannot exploit the vulnerability at will. KEV status is false, and the provided sources do not establish active exploitation.
Researcher notes
The public description identifies the vulnerable behavior but does not provide detailed exploit mechanics in the bundle. Focus assessment on version exposure, risky-command safeguard behavior, user interaction paths, and Splunk audit evidence. Avoid assuming broader Splunk products are affected.
Mitigation direction
- Upgrade Splunk Enterprise 8.1 deployments to 8.1.12 or later.
- Upgrade Splunk Enterprise 8.2 deployments to 8.2.9 or later.
- Review Splunk advisory SVD-2022-1103 for vendor-specific guidance.
- Reinforce phishing controls for users with Splunk access.
Validation and detection
- Inventory Splunk Enterprise versions across production, test, and disaster recovery systems.
- Confirm no 8.1 deployment is below 8.1.12.
- Confirm no 8.2 deployment is below 8.2.9.
- Review Splunk audit activity for unusual risky-command searches or browser-initiated requests.
- Validate risky command safeguards after patching in a controlled environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-43563 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-1103.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.