CVE-2022-43562: 
Splunk Forwarder vulnerability analysis and mitigation

Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2 were affected by a Host header injection vulnerability identified as CVE-2022-43562. The vulnerability was discovered and disclosed on November 2, 2022, affecting the Splunk Web component across multiple versions of Splunk Enterprise and Splunk Cloud Platform (Splunk Advisory).

The vulnerability stems from Splunk Enterprise's failure to properly validate and escape the Host header in HTTP requests. The severity was assessed with a CVSSv3.1 base score of 3.0 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-20 (Improper Input Validation) (NVD).

The vulnerability could enable a remote authenticated user to conduct various attacks against the system, including cross-site scripting and cache poisoning. The impact is primarily limited to potential script injection and manipulation of server-side behavior through specially crafted HTTP requests (Splunk Advisory).

The vulnerability has been patched in Splunk Enterprise versions 8.1.12, 8.2.9, and 9.0.2. For Splunk Cloud Platform, the fix was implemented in version 9.0.2208. Users are advised to upgrade to these or higher versions. No alternative workarounds were provided (Splunk Advisory).