Lucene search

SplunkCVELIST:CVE-2022-37437

HistoryAug 16, 2022 - 7:50 p.m.

CVE-2022-37437 Ingest Actions UI in Splunk Enterprise 9.0.0 disabled TLS certificate validation

2022-08-1619:50:29

CWE-295

Splunk

www.cve.org

cve-2022-37437 splunk enterprise tls-certificates 9.0.0 ingest actions s3_configuration vulnerability

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

49.2%

JSON

When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service (S3) in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions Destination through Splunk Web and only applies to environments that have configured TLS certificate validation. It does not apply to Destinations configured directly in the outputs.conf configuration file. The vulnerability affects Splunk Enterprise version 9.0.0 and does not affect versions below 9.0.0, including the 8.1.x and 8.2.x versions.

CNA Affected

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "status": "affected",
        "version": "9.0.0"
      }
    ]
  }
]

References

www.splunk.com/en_us/product-security/announcements/svd-2022-0801.html

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

49.2%

JSON

Related for CVELIST:CVE-2022-37437