CVE-2022-32156: Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation
First published: Tue Jun 14 2022(Updated: )
In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI to enable the remediation. The vulnerability does not affect the Splunk Cloud Platform. At the time of publishing, we have no evidence of exploitation of this vulnerability by external parties. The issue requires conditions beyond the control of a potential bad actor such as a machine-in-the-middle attack. Hence, Splunk rates the complexity of the attack as High.
Credit: prodsec@splunk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk Splunk | <9.0 | |
| Splunk Universal Forwarder | <9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-32156?
CVE-2022-32156 is a vulnerability in Splunk Enterprise and Universal Forwarder versions before 9.0 that allows the Splunk command-line interface (CLI) to connect to a remote Splunk platform instance without validating TLS certificates.
What is the severity of CVE-2022-32156?
CVE-2022-32156 has a severity score of 8.1, which is considered high.
How does CVE-2022-32156 affect Splunk Enterprise?
CVE-2022-32156 affects Splunk Enterprise versions before 9.0 by allowing the Splunk CLI to connect to a remote Splunk platform instance without validating TLS certificates.
How does CVE-2022-32156 affect Splunk Universal Forwarder?
CVE-2022-32156 affects Splunk Universal Forwarder versions before 9.0 by allowing the Splunk CLI to connect to a remote Splunk platform instance without validating TLS certificates.
How can I fix CVE-2022-32156?
To fix CVE-2022-32156, update Splunk Enterprise and Universal Forwarder to version 9.0 or later and configure TLS hostname validation for the Splunk CLI.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/splunk
- canonical/splunk splunk
- canonical/splunk universal forwarder