CVE-2022-32158: splunk, inc splunk enterprise Improper Access Control
Vulnerability summary
CVE-2022-32158 is a critical (CVSS 10.0) Improper Access Control vulnerability in splunk, inc splunk enterprise. EPSS estimates a 1.47% chance of exploitation in the next 30 days, higher than 73.3% of scored vulnerabilities.
Timeline
- 15-06-2022PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA9.0CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.47%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
+0.03 pp
From 1.43% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Splunk1 product
- splunk< 9.0
Splunk, inc1 product
- splunk enterprise≥ 9.0, < 9.0 | ≥ 8.2, < 8.2.6.1 | ≥ 8.1, < 8.1.10.1
2 vendors · 2 products
References
2 links- docs.splunk.com/Documentation/Splunk/9.0.0/Security/UpdatesX Refsource CONFIRMRelease NotesVendor Advisory
- www.splunk.com/en_us/product-security/announcements/svd-2022-0608.htmlX Refsource CONFIRMVendor Advisory