CVE-2022-32156: Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation
In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#ConfigureTLShostnamevalidationfortheSplunkCLI to enable the remediation. The vulnerability does not affect the Splunk Cloud Platform. At the time of publishing, we have no evidence of exploitation of this vulnerability by external parties.
The issue requires conditions beyond the control of a potential bad actor such as a machine-in-the-middle attack. Hence, Splunk rates the complexity of the attack as High.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-32156?
CVE-2022-32156 is a vulnerability in Splunk Enterprise and Universal Forwarder versions before 9.0 that allows the Splunk command-line interface (CLI) to connect to a remote Splunk platform instance without validating TLS certificates.
What is the severity of CVE-2022-32156?
CVE-2022-32156 has a severity score of 8.1, which is considered high.
How does CVE-2022-32156 affect Splunk Enterprise?
CVE-2022-32156 affects Splunk Enterprise versions before 9.0 by allowing the Splunk CLI to connect to a remote Splunk platform instance without validating TLS certificates.
How does CVE-2022-32156 affect Splunk Universal Forwarder?
CVE-2022-32156 affects Splunk Universal Forwarder versions before 9.0 by allowing the Splunk CLI to connect to a remote Splunk platform instance without validating TLS certificates.
How can I fix CVE-2022-32156?
To fix CVE-2022-32156, update Splunk Enterprise and Universal Forwarder to version 9.0 or later and configure TLS hostname validation for the Splunk CLI.