CVE-2022-32157: Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloads
First published: Wed Jun 15 2022(Updated: )
Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation.
Credit: prodsec@splunk.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Splunk Splunk | <9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates
- https://research.splunk.com/application/splunk_process_injection_forwarder_bundle_downloads/
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html
Frequently Asked Questions
What is CVE-2022-32157?
CVE-2022-32157 is a vulnerability in Splunk Enterprise deployment servers in versions before 9.0 that allows unauthenticated downloading of forwarder bundles.
What is the severity of CVE-2022-32157?
CVE-2022-32157 has a severity rating of 7.5, which is considered high.
How can I fix CVE-2022-32157?
To fix CVE-2022-32157, you need to update the Splunk Enterprise deployment server to version 9.0 and configure authentication for deployment servers and clients.
Where can I find more information about CVE-2022-32157?
You can find more information about CVE-2022-32157 in the Splunk documentation and the Splunk research website.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-32157?
The Common Weakness Enumeration (CWE) ID for CVE-2022-32157 is 306.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/splunk
- canonical/splunk splunk