PT-2022-21124 · Splunk · Universal Forwarder

Chris Green · Published 2022-06-15 · Updated 2022-06-24 · CVE-2022-32155

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Universal Forwarder versions prior to 9.0

Description The universal forwarder has management services available remotely by default in versions before 9.0, which can introduce a potential exposure if not required. In version 9.0, the management port is bound to localhost by default, preventing remote logins. Customers are recommended to assess the potential severity of this exposure specific to their environment.

Recommendations For Universal Forwarder versions prior to 9.0, if management services are not required, set disableDefaultPort = true in server.conf or allowRemoteLogin = never in server.conf or mgmtHostPort = localhost in web.conf to disable remote management services.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-32155

Affected Products

Universal Forwarder

References · 6

• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security · Vendor Advisory
• https://splunk.com/en_us/product-security/announcements/svd-2022-0605.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32155 · Security Note
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32155 · Vendor Advisory
• https://t.me/cvenotify/31664 · Telegram Post