PT-2023-18787 · Splunk · Splunk Cloudconnect Sdk+1

Chris Green · Published 2023-02-14 · Updated 2024-04-10 · CVE-2023-22943

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Splunk Add-on Builder versions prior to 4.1.2 Splunk CloudConnect SDK versions prior to 3.1.3

Description The issue occurs when requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS. This affects not only the Splunk Add-on Builder but also apps generated by it when using the REST API Modular Input functionality, as well as potentially third-party apps and add-ons that directly call the cloudconnectlib.splunktacollectorlib.cloud connect mod input Python class.

Recommendations For Splunk Add-on Builder versions prior to 4.1.2, update to version 4.1.2 or later. For Splunk CloudConnect SDK versions prior to 3.1.3, update to version 3.1.3 or later. As a temporary workaround, consider restricting the use of the REST API Modular Input functionality until a patch is applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-636

CWE-295

Related Identifiers

CVE-2023-22943

Affected Products

Splunk Add-On Builder

Splunk Cloudconnect Sdk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-22943 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22943 · Vendor Advisory
• https://advisory.splunk.com/advisories/SVD-2023-0213 · Vendor Advisory
• https://t.me/cvenotify/71759 · Telegram Post
• https://t.me/cibsecurity/58128 · Telegram Post