CVE-2022-32157 json
Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloads
published 2022-06-15 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-53394
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 72%
- public exploits
- 0
- none known
Summary
Splunk Enterprise deployment servers in versions before 9.0 allow unauthenticated downloading of forwarder bundles. Remediation requires you to update the deployment server to version 9.0 and Configure authentication for deployment servers and clients (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_servers_and_clients). Once enabled, deployment servers can manage only Universal Forwarder versions 9.0 and higher. Though the vulnerability does not directly affect Universal Forwarders, remediation requires updating all Universal Forwarders that the deployment server manages to version 9.0 or higher prior to enabling the remediation.
Patch / fix
- splunk splunk 9.0
Exploit prediction
1.38% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Splunk, Inc Splunk Enterprise
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
docs.splunk.com
/Documentation/Splunk/9.0.0/Security/Updates
release-notes, vendor-advisory
-
splunk.com
/en_us/product-security/announcements/svd-2022-0607.html
vendor-advisory
-
docs.splunk.com
/Documentation/Splunk/9.0.0/Security/ConfigDSDCAuthEnhancements#Configure_authentication_for_deployment_server
mitigation, vendor-advisory
-
research.splunk.com
/application/splunk_process_injection_forwarder_bundle_downloads/
mitigation, vendor-advisory
Sources
- CVE List CVE-2022-32157
- NVD CVE-2022-32157
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.