CVE-2022-32157: splunk, inc splunk enterprise
Vulnerability summary
CVE-2022-32157 is a high (CVSS 7.5) vulnerability in splunk, inc splunk enterprise. EPSS estimates a 1.35% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities.
Timeline
- 15-06-2022PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.35%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
+0.03 pp
From 1.32% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk1 product
- splunk< 9.0
Splunk, inc1 product
- splunk enterprise≥ 9.0, < 9.0
2 vendors · 2 products
References
4 links- docs.splunk.com/Documentation/Splunk/9.0.0/Security/UpdatesX Refsource CONFIRMRelease NotesVendor Advisory
- www.splunk.com/en_us/product-security/announcements/svd-2022-0607.htmlX Refsource CONFIRMVendor Advisory
- docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancementsX Refsource CONFIRMMitigationVendor Advisory
- research.splunk.com/application/splunk_process_injection_forwarder_bundle_downloads/X Refsource CONFIRMMitigationVendor Advisory