CVE-2022-32152: 
Splunk Forwarder vulnerability analysis and mitigation

CVE-2022-32152 is a security vulnerability affecting Splunk Enterprise versions before 9.0 and Splunk Cloud Platform versions before 8.2.2203, discovered in June 2022. The vulnerability relates to TLS certificate validation during Splunk-to-Splunk communications, where peer communications were not validating TLS certificates by default (Splunk Advisory).

The vulnerability is classified as CWE-295 and received a CVSSv3.1 score of 8.1 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from the lack of default TLS certificate validation during inter-Splunk communications, potentially allowing connections from misconfigured nodes without valid certificates to succeed (Splunk Advisory).

While Splunk peer communications properly configured with valid certificates were not vulnerable, the flaw could allow an administrator to add a peer without a valid certificate, and connections from misconfigured nodes without valid certificates would not fail by default. This could potentially lead to unauthorized access and compromise of secure communications (Splunk Advisory).

For Splunk Enterprise users, the recommended mitigation is to upgrade to version 9.0 or higher and configure TLS host validation for Splunk-to-Splunk communications. For Splunk Cloud Platform customers, Splunk actively patched and monitored affected Cloud instances to version 8.2.2203 or higher (Splunk Advisory).