CVE-2022-32151: splunk, inc splunk cloud platform Improper Certificate Validation
Vulnerability summary
CVE-2022-32151 is a critical (CVSS 9.1) Improper Certificate Validation vulnerability in splunk, inc splunk cloud platform. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.8% of scored vulnerabilities.
Timeline
- 15-06-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority (CA) certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries now verify server certificates by default and use the appropriate CA certificate stores for each library. Apps and add-ons that include their own HTTP libraries are not affected. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
EPSS trend
Probability
0.80%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
+0.02 pp
From 0.78% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk2 products
- splunk< 9.0
- splunk_cloud_platform< 8.2.2203
Splunk, inc2 products
- splunk cloud platform≥ 8.2, < 8.2.2203
- splunk enterprise≥ 9.0, < 9.0
2 vendors · 4 products
References
4 links- www.splunk.com/en_us/product-security/announcements/svd-2022-0601.htmlX Refsource CONFIRMVendor Advisory
- docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidationX Refsource CONFIRMVendor Advisory
- docs.splunk.com/Documentation/Splunk/9.0.0/Security/UpdatesX Refsource CONFIRMRelease NotesVendor Advisory
- research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_simplerequest/X Refsource CONFIRMMitigationVendor Advisory