PT-2022-21125 · Splunk · Splunk Cloud Platform+2

Chris Green · Published 2022-06-14 · Updated 2026-02-25 · CVE-2022-32156

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Splunk Enterprise and Universal Forwarder versions prior to 9.0

Description The issue is related to the Splunk command-line interface (CLI) not validating TLS certificates while connecting to a remote Splunk platform instance by default. This requires conditions beyond the control of a potential bad actor, such as a machine-in-the-middle attack, and is rated as a High complexity attack. There is no evidence of exploitation of this issue by external parties at the time of publishing. The Splunk Cloud Platform is not affected.

Recommendations For Splunk Enterprise and Universal Forwarder versions prior to 9.0, update to version 9.0 and follow the documentation to enable TLS host name validation for the Splunk CLI. This can be done by configuring the settings as described in the Splunk documentation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-32156

Affected Products

Splunk Cloud Platform

Splunk Enterprise

Universal Forwarder

References · 10

• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates · Vendor Advisory
• https://splunk.com/en_us/product-security/announcements/svd-2022-0606.html · Vendor Advisory
• https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32156 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32156 · Vendor Advisory
• https://t.me/cveNotify/153172 · Telegram Post
• https://t.me/cvenotify/37553 · Telegram Post
• https://t.me/cvenotify/31663 · Telegram Post
• https://t.me/cvenotify/37655 · Telegram Post
• https://t.me/cibsecurity/44546 · Telegram Post