by Kastro
Paper/Archive/CVE-2022-32158

CVE-2022-32158

Splunk, Inc Splunk Enterprise — Splunk Enterprise deployment servers allow client publishing of forwarder bundles

EPSS 1%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 73.7.737 × 2014.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.

Affected

ProductAffectedFixed inSource
Splunk Enterprise9.0 – < 9.09.0CNA
Splunk Enterprise8.2 – < 8.2.6.18.2.6.1CNA
Splunk Enterprise8.1 – < 8.1.10.18.1.10.1CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Splunk (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refdocs.splunk.com/Documentation/Splunk/9.0.0/Security/Updatesrefsplunk.com/en_us/product-security/announcements/svd-2022-0608.html