Design/Logic Flaw

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI...

Design/Logic Flaw

Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable...

Hardcoded credentials

The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority CA certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries...

CVE-2022-32158 Splunk Enterprise deployment servers allow client publishing of forwarder bundles

Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on a...

CVE-2022-32157 Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloads

Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients...

CVE-2022-32154 Risky commands warnings in Splunk Enterprise Dashboards

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and...

CVE-2022-32154

Splunk Enterprise before 9.0 is affected by CVE-2022-32154 in its dashboards: an attacker could inject risky search commands into a form token used in a cross-origin query, bypassing SPL safeguards for risky commands. The issue is browser-based; exploitation depends on the attacker delivering a f...

CVE-2022-32152 Splunk Enterprise lacked TLS cert validation for Splunk-to-Splunk communication by default

Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable...

CVE-2022-32152

CVE-2022-32152 affects Splunk Enterprise and Splunk Cloud Platform where TLS host name validation for Splunk-to-Splunk communications was not enforced by default in versions before 9.0 (Splunk Enterprise) and before 8.2.2203 (Splunk Cloud). The issue allowed an administrator to add a peer with an...

CVE-2022-32154: Improper Input Validation

Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and...

PT-2022-21121

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0 Splunk Cloud Platform versions prior to 8.2.2203 Description The issue concerns the lack of TLS certificate validation during Splunk-to-Splunk communications by default in affected versions. This could...

CVE-2022-32158: Improper Access Control

Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on a...

CVE-2022-32157: Missing Authentication for Critical Function

Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients...

CVE-2022-32152: Improper Certificate Validation

Splunk Enterprise peers in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203 did not validate the TLS certificates during Splunk-to-Splunk communications by default. Splunk peer communications configured properly with valid certificates were not vulnerable...

CVE-2022-32151: Improper Certificate Validation

The httplib and urllib Python libraries that Splunk shipped with Splunk Enterprise did not validate certificates using the certificate authority CA certificate stores by default in Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203. Python 3 client libraries...

PT-2022-3325

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 8.1.10.1 Splunk Enterprise versions prior to 8.2.6.1 Splunk Enterprise versions prior to 9.0 Description The issue is related to inadequate access control in Splunk Enterprise deployment servers, allowing an...

PT-2022-21122

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0 Splunk Cloud Platform versions prior to 8.2.2203 Description The issue concerns the lack of TLS certificate validation during Splunk-to-Splunk communications by default in affected versions. This could...

PT-2022-21120

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.0 Splunk Cloud Platform versions prior to 8.2.2203 Description The issue concerns the httplib and urllib Python libraries in Splunk, which did not validate certificates using the certificate authority CA...

Splunk 信任管理问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Splunk 信任管理问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...