CVE-2022-26889: Path Traversal in search parameter results in external content injection
First published: Fri May 06 2022(Updated: )
In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to initiate a request within the victim's browser (e.g., phishing).
Credit: prodsec@splunk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk | >=8.1.0<8.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-26889?
CVE-2022-26889 has been classified as a high severity vulnerability due to its potential to allow attackers to perform path traversal and inject arbitrary content.
How do I fix CVE-2022-26889?
To mitigate CVE-2022-26889, upgrade your Splunk Enterprise to version 8.1.2 or later.
What are the potential impacts of CVE-2022-26889?
The potential impacts of CVE-2022-26889 include the ability to execute XSS attacks or bypass SPL safeguards.
Which Splunk versions are affected by CVE-2022-26889?
CVE-2022-26889 affects Splunk Enterprise versions prior to 8.1.2.
How can I determine if my system is vulnerable to CVE-2022-26889?
Check your Splunk Enterprise version and see if it is below 8.1.2 to determine if your system is vulnerable to CVE-2022-26889.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/author
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/splunk
- canonical/splunk
- version/splunk/8.1.0