cve-2021-3422
Vulnerability from cvelistv5
Published
2022-03-25 18:02
Modified
2024-08-03 16:53
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.
References
prodsec@splunk.comhttps://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/Third Party Advisory
prodsec@splunk.comhttps://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.htmlVendor Advisory
Impacted products
Vendor Product Version
Splunk Splunk Enterprise Version: 8.2 version(s) before 8.2.0
Version: 8.1 version(s) before 8.1.3
Version: 8.0 version(s) before 8.0.9
Version: 7.3 version(s) before 7.3.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T16:53:17.577Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Splunk Enterprise",
               vendor: "Splunk",
               versions: [
                  {
                     status: "affected",
                     version: "8.2 version(s) before 8.2.0",
                  },
                  {
                     status: "affected",
                     version: "8.1 version(s) before 8.1.3",
                  },
                  {
                     status: "affected",
                     version: "8.0 version(s) before 8.0.9",
                  },
                  {
                     status: "affected",
                     version: "7.3 version(s) before 7.3.9",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Sharon Brizinov and Tal Keren of Claroty",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-125",
                     description: "CWE-125 Out-of-bounds Read",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-28T18:52:58",
            orgId: "42b59230-ec95-491e-8425-5a5befa1a469",
            shortName: "Splunk",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/",
            },
         ],
         source: {
            advisory: "SVD-2022-0301",
            discovery: "EXTERNAL",
         },
         title: "Indexer denial-of-service via malformed S2S request",
         x_generator: {
            engine: "advisoriator",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "prodsec@splunk.com",
               ID: "CVE-2021-3422",
               STATE: "PUBLIC",
               TITLE: "Indexer denial-of-service via malformed S2S request",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Splunk Enterprise",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "8.2 version(s) before 8.2.0",
                                       },
                                       {
                                          version_value: "8.1 version(s) before 8.1.3",
                                       },
                                       {
                                          version_value: "8.0 version(s) before 8.0.9",
                                       },
                                       {
                                          version_value: "7.3 version(s) before 7.3.9",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Splunk",
                     },
                  ],
               },
            },
            credit: [
               {
                  lang: "eng",
                  value: "Sharon Brizinov and Tal Keren of Claroty",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.",
                  },
               ],
            },
            generator: {
               engine: "advisoriator",
            },
            impact: {
               cvss: {
                  baseScore: "7.5",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-125 Out-of-bounds Read",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html",
                     refsource: "MISC",
                     url: "https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html",
                  },
                  {
                     name: "https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/",
                     refsource: "MISC",
                     url: "https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/",
                  },
               ],
            },
            source: {
               advisory: "SVD-2022-0301",
               discovery: "EXTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "42b59230-ec95-491e-8425-5a5befa1a469",
      assignerShortName: "Splunk",
      cveId: "CVE-2021-3422",
      datePublished: "2022-03-25T18:02:43",
      dateReserved: "2021-03-03T00:00:00",
      dateUpdated: "2024-08-03T16:53:17.577Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2021-3422\",\"sourceIdentifier\":\"prodsec@splunk.com\",\"published\":\"2022-03-25T19:15:08.983\",\"lastModified\":\"2024-11-21T06:21:28.057\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium.\"},{\"lang\":\"es\",\"value\":\"La falta de validación de un campo clave-valor en el protocolo Splunk-to-Splunk resulta en una denegación de servicio en las instancias de Splunk Enterprise configuradas para indexar el tráfico de Universal Forwarder. La vulnerabilidad afecta a las versiones de Splunk Enterprise anteriores a la 7.3.9, a las versiones 8.0 anteriores a la 8.0.9 y a las versiones 8.1 anteriores a la 8.1.3. No afecta a los Universal Forwarders. Cuando el reenvío de Splunk está asegurado usando TLS o un Token, el ataque requiere comprometer el certificado o el token, o ambos. La implementación de uno o ambos reduce la severidad a Media\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"prodsec@splunk.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"prodsec@splunk.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*\",\"versionEndExcluding\":\"7.3.9\",\"matchCriteriaId\":\"C665B104-D5C6-409F-90D4-814E4B5D5EB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"8.0\",\"versionEndExcluding\":\"8.0.9\",\"matchCriteriaId\":\"72AD8803-DF95-453E-90D0-70A74E5CA98D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"8.1\",\"versionEndExcluding\":\"8.1.3\",\"matchCriteriaId\":\"445E103F-DBC2-4E74-94EF-9302EA945C27\"}]}]}],\"references\":[{\"url\":\"https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/\",\"source\":\"prodsec@splunk.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html\",\"source\":\"prodsec@splunk.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://claroty.com/2022/03/24/blog-research-locking-down-splunk-enterprise-indexers-and-forwarders/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.splunk.com/en_us/product-security/announcements/svd-2022-0301.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.