Vulnerability · Published Jun 15, 2022 · Assigned by Splunk
CVE-2022-32158Splunk Enterprise deployment servers allow client publishing of forwarder bundles
Critical 9.0
In plain English
A critical-severity improper access control in Splunk Enterprise from Splunk, Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Official description
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Splunk, Inc | Splunk Enterprise | 9.0 – before 9.08.2 – before 8.2.6.18.1 – before 8.1.10.1 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/Updates x_refsource_CONFIRM
- https://www.splunk.com/en_us/product-security/announcements/svd-2022-0608.html x_refsource_CONFIRM