What’s Vulnerable › Vulnerabilities

CVE-2023-22943: Modular Input REST API Requests Connect via HTTP after Certificate Validation Failure in Splunk Add-on Builder and Splunk CloudConnect SDK

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-14 · updated 2026-06-17
• Weakness: CWE-636

Description

In Splunk Add-on Builder (AoB) versions below 4.1.2 and the Splunk CloudConnect SDK versions below 3.1.3, requests to third-party APIs through the REST API Modular Input incorrectly revert to using HTTP to connect after a failure to connect over HTTPS occurs.

Affected products

• Splunk Add-on Builder: from 4.1.0 before 4.1.2 — fixed in 4.1.2
• Splunk Cloudconnect Software Development Kit: from 3.1.0 before 3.1.3 — fixed in 3.1.3

How to fix

Upgrade to a fixed version: Splunk Add-on Builder 4.1.2; Splunk Cloudconnect Software Development Kit 3.1.3. Check the vendor advisory for mitigations.

References

• https://advisory.splunk.com/advisories/SVD-2023-0213
• https://advisory.splunk.com/advisories/SVD-2023-0213

Get alerted when CVE-2023-22943 or the next vulnerability affects your stack