Splunk Enterprise and Universal Forwarder < 9.0 Improper Certificate Validation

critical Nessus Plugin ID 164078


An application running on a remote web server host is affected by an improper certificate validation vulnerability.


In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. Splunk peer communications configured properly with valid certificates were not vulnerable. However, connections from misconfigured nodes without valid certificates did not fail by default.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.


Upgrade Splunk Enterprise or Universal Forwarder to version 9.0 or later.

See Also


Plugin Details

Severity: Critical

ID: 164078

File Name: splunk_900_cve-2022-32156.nasl

Version: 1.5

Type: combined

Agent: windows, macosx, unix

Family: CGI abuses

Published: 8/11/2022

Updated: 9/23/2022

Supported Sensors: Nessus Agent

Risk Information


Risk Factor: Medium

Score: 5.9


Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2022-32156


Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:splunk:splunk, cpe:/a:splunk:universal_forwarder

Exploit Ease: No known exploits are available

Patch Publication Date: 6/14/2022

Vulnerability Publication Date: 6/14/2022

Reference Information

CVE: CVE-2022-32156

IAVA: 2022-A-0251-S