CVE-2022-32153: splunk, inc splunk cloud platform
Vulnerability summary
CVE-2022-32153 is a high (CVSS 8.1) vulnerability in splunk, inc splunk cloud platform. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.5% of scored vulnerabilities.
Timeline
- 15-06-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, an attacker with administrator credentials could add a peer without a valid certificate and connections from misconfigured nodes without valid certificates did not fail by default. For Splunk Enterprise, update to Splunk Enterprise version 9.0 and Configure TLS host name validation for Splunk-to-Splunk communications (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation) to enable the remediation.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
+0.02 pp
From 0.90% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-297Improper Validation of Certificate with Host MismatchThe product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
- CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.
Affected systems
Splunk2 products
- splunk< 9.0
- splunk_cloud_platform< 8.2.2203
Splunk, inc2 products
- splunk cloud platform≥ 8.2, < 8.2.2203
- splunk enterprise≥ 9.0, < 9.0
2 vendors · 4 products
References
7 links- docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidationX Refsource CONFIRMMitigationVendor Advisory
- docs.splunk.com/Documentation/Splunk/9.0.0/Security/UpdatesX Refsource CONFIRMRelease NotesVendor Advisory
- research.splunk.com/application/splunk_digital_certificates_infrastructure_version/X Refsource CONFIRMMitigationVendor Advisory
- research.splunk.com/application/splunk_digital_certificates_lack_of_encryption/X Refsource CONFIRMMitigationVendor Advisory
- research.splunk.com/application/splunk_protocol_impersonation_weak_encryption_selfsigned/X Refsource CONFIRMMitigationVendor Advisory
- research.splunk.com/network/splunk_identified_ssl_tls_certificates/X Refsource CONFIRMMitigationVendor Advisory
- www.splunk.com/en_us/product-security/announcements/svd-2022-0603.htmlX Refsource CONFIRMVendor Advisory