Vulnerability record · CVE-2022-37438 · published 16 August 2022
CVE-2022-37438: Splunk information exposure vulnerability
Splunk · Splunk
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user access to create and share dashboards using Splunk Web.
Description
In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information (for example, username, email, and real name) about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user access to create and share dashboards using Splunk Web.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://research.splunk.com/application/f844c3f6-fd99-43a2-ba24-93e35fe84be6 | Vendor Advisory |
| https://www.splunk.com/en_us/product-security/announcements/svd-2022-0802.html | MitigationVendor Advisory |
| https://research.splunk.com/application/f844c3f6-fd99-43a2-ba24-93e35fe84be6 | Vendor Advisory |
| https://www.splunk.com/en_us/product-security/announcements/svd-2022-0802.html | MitigationVendor Advisory |
Track CVE-2022-37438 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-37438), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.
