CVE-2022-32158 CRITICAL

CVE-2022-32158: Splunk Enterprise deployment servers allow client publishing of forwarder bundles

Vendor Splunk, Inc
Product Splunk Enterprise
Weakness CWE-284
Published June 15, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

9.0/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Splunk Enterprise deployment servers in versions before 8.1.10.1, 8.2.6.1, and 9.0 let clients deploy forwarder bundles to other deployment clients through the deployment server. An attacker that compromised a Universal Forwarder endpoint could use the vulnerability to execute arbitrary code on all other Universal Forwarder endpoints subscribed to the deployment server.

Key dates

02Disclosure timeline

June 15, 2022 CVE published
September 17, 2024 Record updated