CVE-2023-22943

Modular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK

State: Published
Severity: 4.8 Medium
Published: Feb 14, 2023
Updated: Feb 28, 2025
Reserved: Jan 10, 2023

Read the record on cve.org

Description

In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	Splunk

Weaknesses

CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Affected Products

Product	Versions
Splunk Add-on BuilderSplunk	4.1 to before 4.1.2Affected
Splunk CloudConnect SDKSplunk	3.1 to before 3.1.3Affected

References

https://advisory.splunk.com/advisories/SVD-2023-0213

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.