CVE-2022-43567
Assigner: Splunk
Published: 2022-11-04T22:21:50.819Z
State: PUBLISHED
affected: defaultStatus: affected
product: Splunk Enterprise
vendor: Splunk
versions: lessThan: 8.1.12
status: affected
version: 8.1
versionType: custom
lessThan: 8.2.9
status: affected
version: 8.2
versionType: custom
lessThan: 9.0.2
status: affected
version: 9.0
versionType: custom
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Danylo Dmytriiev (DDV_UA)
datePublic: 2022-11-02T16:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.</span><br>
value: In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app.

metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-502
description: CWE-502 Deserialization of Untrusted Data
type: CWE
source: advisory: SVD-2022-1107
discovery: EXTERNAL
title: Remote Code Execution via the Splunk Secure Gateway application Mobile Alerts feature