Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-32155

In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the universal forwarder now binds the management port to localhost preventing remote logins by default. If management services are not required in versions before 9.0, set disableDefaultPort = true in server.conf OR allowRemoteLogin = never in server.conf OR mgmtHostPort = localhost in web.conf. See Configure universal forwarder management security (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security) for more information on disabling the remote management services.

Published

2022-06-15T17:15:09.087

Last Modified

2024-11-21T07:05:51.250

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-732

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	splunk	splunk	< 9.0	Yes
Application	splunk	splunk_cloud_platform	< 8.2.2106	Yes

References

https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security Mitigation, Vendor Advisory ([email protected])
https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates Release Notes, Vendor Advisory ([email protected])
https://www.splunk.com/en_us/product-security/announcements/svd-2022-0605.html Vendor Advisory ([email protected])
https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security Mitigation, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.splunk.com/en_us/product-security/announcements/svd-2022-0605.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)