CVE-2021-3422

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-3422
The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/ Third Party Advisory
https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
History

11 Apr 2022, 19:51

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 4.3
v3 : 7.5
CWE CWE-20
CPE cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*
First Time Splunk splunk
Splunk
References (MISC) https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html - (MISC) https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html - Vendor Advisory
References (MISC) https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/ - (MISC) https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/ - Third Party Advisory

28 Mar 2022, 19:15

Type Values Removed Values Added
References
  • {'url': 'https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/2', 'name': 'https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/2', 'tags': [], 'refsource': 'MISC'}
  • (MISC) https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/ -
Summary The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. See https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Enableareceiver for more information on configuring an indexer to listen for UF traffic. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. As a partial mitigation and a security best practice, see https://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousesignedcertificates and https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/Controlforwarderaccess. Implementation of either or both reduces the severity to Medium. The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.

25 Mar 2022, 19:44

Type Values Removed Values Added
New CVE
Information

Published : 2022-03-25 19:15

Updated : 2023-12-10 14:22

NVD link : CVE-2021-3422

Mitre link : CVE-2021-3422

CVE.ORG link : CVE-2021-3422

JSON object : View

Products Affected

splunk

  • splunk
CWE
CWE-20

Improper Input Validation

CWE-125

Out-of-bounds Read