Splunk Authenticated RCE via SimpleXML Dashboard PDF (CVE-2022-43571)

Exploits CVE-2022-43571 in Splunk Enterprise: authenticated Python code injection via sparkline style parameters fillColor/lineColor in a SimpleXML dashboard. Payload executes when PDF export is triggered. Affected: versions prior to 8.1.12, 8.2.0 through 8.2.8, and 9.0.0 through 9.0.1. Requires...