TI-2022-21342 Aliases CVE-2022-43565 GHSA-fw8m-f5g8-v52m

Risky command safeguards bypass via ‘tstats command JSON in Splunk Enterprise

MEDIUM 41CWE-20Published 2022-11-04 · Updated 2025-05-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL safeguards for risky commands https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SPLsafeguards . The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00793 56th percentileScored 2026-11-07

Fix Fixed Splunk Enterprise (Splunk): 8.1.12, 8.2.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Splunk	Splunk Enterprise	8.1 to before 8.1.12; 8.2 to before 8.2.9	8.1.12, 8.2.9	Patch available	CNA

Splunk Enterprise VendorSplunk Affected 8.1 to before 8.1.12; 8.2 to before 8.2.9 Fixed in 8.1.12, 8.2.9 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:splunk:splunk:::::enterprise:::*	8.1.0 to before 8.1.12; 8.2.0 to before 8.2.9	Vulnerable	Splunk
cpe:2.3:a:splunk:splunk_cloud_platform::::::::	before 9.0.2203	Vulnerable	Splunk

cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:* Versions 8.1.0 to before 8.1.12; 8.2.0 to before 8.2.9 Vulnerable ·Splunk
cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:* Versions before 9.0.2203 Vulnerable ·Splunk

Remediation

Fix · CNA Splunk Enterprise (Splunk) Fixed in 8.1.12, 8.2.9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-11-04
Splunk Enterprise 8.1.12, 8.2.9
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2022-21340 Risky command safeguards bypass via rex search command field names in Splunk EnterprisePriority MEDIUM 41
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-43565
2026-10-03 Alias added: GHSA-fw8m-f5g8-v52m
2026-10-11 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://www.splunk.com/en_us/product-security/announcements/svd-2022-1105.html

TI-2026-16444 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise KEVCVSS 3.1CRITICAL 9.8
TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
TI-2023-24841 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing CVSS 3.1HIGH 8.8
TI-2023-15979 ‘edit_user’ Capability Privilege Escalation CVSS 3.1HIGH 8.8
TI-2024-30707 Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows CVSS 3.1HIGH 8.8
TI-2022-21345 Reflected Cross-Site Scripting via the radio template in Splunk Enterprise CVSS 3.1HIGH 8.8

See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences