CVE-2022-43569: Splunk

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting (XSS) in the object name of a Data Model.

Affected products

• Splunk Splunk: from 8.1.0, before 8.1.12 (fixed in 8.1.12); from 8.2.0, before 8.2.9 (fixed in 8.2.9); from 9.0.0, before 9.0.2 (fixed in 9.0.2)
• Splunk Splunk Cloud Platform: before 9.0.2209 (fixed in 9.0.2209)

Published 2022-11-04. Last modified 2026-06-17.