CVE-2022-32156

Name of the Vulnerable Software and Affected Versions Splunk Enterprise and Universal Forwarder versions prior to 9.0

Description The issue is related to the Splunk command-line interface (CLI) not validating TLS certificates while connecting to a remote Splunk platform instance by default. This requires conditions beyond the control of a potential bad actor, such as a machine-in-the-middle attack, and is rated as a High complexity attack. There is no evidence of exploitation of this issue by external parties at the time of publishing. The Splunk Cloud Platform is not affected.

Recommendations For Splunk Enterprise and Universal Forwarder versions prior to 9.0, update to version 9.0 and follow the documentation to enable TLS host name validation for the Splunk CLI. This can be done by configuring the settings as described in the Splunk documentation.