CVE-2022-32155: In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but…

PriorityP348high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

1.80%

75.7th percentile

In universal forwarder versions before 9.0, management services are available remotely by default. When not required, it introduces a potential exposure, but it is not a vulnerability. If exposed, we recommend each customer assess the potential severity specific to your environment. In 9.0, the universal forwarder now binds the management port to localhost preventing remote logins by default. If management services are not required in versions before 9.0, set disableDefaultPort = true in server.conf OR allowRemoteLogin = never in server.conf OR mgmtHostPort = localhost in web.conf. See Configure universal forwarder management security (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_universal_forwarder_management_security) for more information on disabling the remote management services.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
splunk	splunk	< 9.0	9.0
splunk	splunk_cloud_platform	< 8.2.2106	8.2.2106
splunk_inc	universal_forwarder	>= 9.0 < 9.0	9.0

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.