TI-2023-09075 Aliases CVE-2023-22943 GHSA-jjqg-fqrm-g2vj

Improper certificate validation in Splunk Add-on Builder

LOW 24CWE-636Published 2023-02-14 · Updated 2025-02-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.

Summary

In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.

Why it matters now

EPSS 0.00315 24th percentileScored 2026-11-07

Fix Fixed Splunk Add-on Builder (Splunk): 4.1.2Splunk CloudConnect SDK (Splunk): 3.1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Splunk	Splunk Add-on Builder	4.1 to before 4.1.2	4.1.2	Patch available	CNA
Splunk	Splunk CloudConnect SDK	3.1 to before 3.1.3	3.1.3	Patch available	CNA

Splunk Add-on Builder VendorSplunk Affected 4.1 to before 4.1.2 Fixed in 4.1.2 Patch available CNA
Splunk CloudConnect SDK VendorSplunk Affected 3.1 to before 3.1.3 Fixed in 3.1.3 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:splunk:add-on_builder::::::::	4.1.0 to before 4.1.2	Vulnerable	Splunk
cpe:2.3:a:splunk:cloudconnect_software_development_kit::::::::	3.1.0 to before 3.1.3	Vulnerable	Splunk

cpe:2.3:a:splunk:add-on_builder:*:*:*:*:*:*:*:* Versions 4.1.0 to before 4.1.2 Vulnerable ·Splunk
cpe:2.3:a:splunk:cloudconnect_software_development_kit:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.1.3 Vulnerable ·Splunk

Remediation

Fix · CNA Splunk Add-on Builder (Splunk) Fixed in 4.1.2
Fix · CNA Splunk CloudConnect SDK (Splunk) Fixed in 3.1.3

Timeline

2026-10-02 Threatist record created from CVE-2023-22943
2026-10-03 Alias added: GHSA-jjqg-fqrm-g2vj

References

Advisory 1

https://advisory.splunk.com/advisories/SVD-2023-0213

TI-2023-24858 Session Token Disclosure to Internal Log Files in Splunk Add-on Builder CVSS 3.1HIGH 8.8
TI-2023-24857 Sensitive Information Disclosure to Internal Log Files in Splunk Add-on Builder CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences