CVE-2022-43567: 
Splunk Forwarder vulnerability analysis and mitigation

CVE-2022-43567 affects Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2. The vulnerability allows an authenticated user to execute arbitrary operating system commands remotely through specially crafted requests to the mobile alerts feature in the Splunk Secure Gateway app. This vulnerability was disclosed on November 2, 2022, and received a CVSS v3.1 base score of 8.8 (High) (Splunk Advisory).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack vector requires network access, has low attack complexity, requires low privileges, needs no user interaction, and has high impacts on confidentiality, integrity, and availability (NVD).

The vulnerability allows authenticated attackers to execute arbitrary operating system commands on the affected Splunk Enterprise server. This could lead to complete system compromise with high impacts on confidentiality, integrity, and availability of the affected system (SecurityWeek).

The vulnerability can be remediated by upgrading Splunk Enterprise to versions 8.1.12, 8.2.9, 9.0.2, or higher. Alternative mitigations include removing, disabling, or uninstalling the Splunk Secure Gateway app, or restricting access to the app to administrators only (Splunk Advisory).