PT-2022-23998 · Splunk · Universal Forwarder+1

Tim Ip · Published 2022-08-16 · Updated 2022-08-18 · CVE-2022-37439

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Splunk Enterprise and Universal Forwarder (affected versions not specified)

Description The issue occurs when indexing a specially crafted ZIP file using the file monitoring input, which can cause the application to crash. Upon attempting to restart the application, it will crash again, requiring manual removal of the malformed file to resolve the issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2022-37439

Affected Products

Splunk Enterprise

Universal Forwarder

References · 5

• https://osv.dev/vulnerability/CVE-2022-37439 · Vendor Advisory
• https://splunk.com/en_us/product-security/announcements/svd-2022-0803.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37439 · Security Note
• https://research.splunk.com/application/b237d393-2f57-4531-aad7-ad3c17c8b041 · Vendor Advisory
• https://t.me/true_secator/3306 · Telegram Post