CVE-2022-27183

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platform instances. Note that the Cloud Monitoring Console is not impacted.

• CWE-79
• CWE-79

• https://research.splunk.com/application/splunk_xss_in_monitoring_console/Vendor Advisory
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.htmlVendor Advisory
• https://research.splunk.com/application/splunk_xss_in_monitoring_console/Vendor Advisory
• https://www.splunk.com/en_us/product-security/announcements/svd-2022-0505.htmlVendor Advisory

Published

May 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-27178A denial of service vulnerability exists in the confctl_set_…9.8
• CVE-2022-27179A malicious actor having access to the exported configuratio…6.5
• CVE-2022-2718The JoomSport – for Sports: Team & League, Football, Hockey …4.9
• CVE-2022-27180Uncontrolled search path in the Intel(R) MacCPUID software b…7.8
• CVE-2022-27181On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x v…5.3
• CVE-2022-27182On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versi…5.3
• CVE-2022-27184The affected product is vulnerable to an out-of-bounds write…7.8
• CVE-2022-27185A denial of service vulnerability exists in the confctl_set_…7.5
• CVE-2022-27187Uncontrolled search path element in the Intel(R) Quartus Pri…7.8
• CVE-2022-27188OS command injection vulnerability exists in CENTUM VP R4.01…7.8
• CVE-2022-27189On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versi…7.5
• CVE-2022-2719In ImageMagick, a crafted file could trigger an assertion fa…5.5