Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-32153

Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.

Published

2022-06-15T17:15:08.950

Last Modified

2024-11-21T07:05:50.950

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-297
Type: Primary
CWE-295

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	splunk	splunk	< 9.0	Yes
Application	splunk	splunk_cloud_platform	< 8.2.2203	Yes

References

https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation Mitigation, Vendor Advisory ([email protected])
https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates Release Notes, Vendor Advisory ([email protected])
https://research.splunk.com/application/splunk_digital_certificates_infrastructure_version/ Mitigation, Vendor Advisory ([email protected])
https://research.splunk.com/application/splunk_digital_certificates_lack_of_encryption/ Mitigation, Vendor Advisory ([email protected])
https://research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_selfsigned/ Mitigation, Vendor Advisory ([email protected])
https://research.splunk.com/network/splunk_identified_ssl_tls_certificates/ Mitigation, Vendor Advisory ([email protected])
https://www.splunk.com/en_us/product-security/announcements/svd-2022-0603.html Vendor Advisory ([email protected])
https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://research.splunk.com/application/splunk_digital_certificates_infrastructure_version/ Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://research.splunk.com/application/splunk_digital_certificates_lack_of_encryption/ Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_selfsigned/ Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://research.splunk.com/network/splunk_identified_ssl_tls_certificates/ Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.splunk.com/en_us/product-security/announcements/svd-2022-0603.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)