CVE-2022-32157
Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloads
- State
- Published
- Severity
- 7.5 High
- Published
- Jun 15, 2022
- Updated
- Sep 17, 2024
- Reserved
- May 31, 2022
Description
Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | Splunk |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
Splunk EnterpriseSplunk, Inc |
|
References
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0607.html
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients
- https://research.splunk.com/application/splunk_process_injection_forwarder_bundle_downloads/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.