A vulnerability, which was classified as critical, was found in Splunk Enterprise and Cloud Platform (Log Management Software) (affected version not known). Affected is some unknown functionality of the component Splunk-to-Splunk Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. CWE is classifying the issue as CWE-295. The product does not validate, or incorrectly validates, a certificate. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.

The weakness was shared 06/15/2022. The advisory is available at docs.splunk.com. This vulnerability is traded as CVE-2022-32152 since 05/31/2022. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1587.003 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

Productinfo

Type

• Log Management Software

Vendor

• Splunk

Name

• Cloud Platform
• Enterprise

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion