CVE Vulnerability Catalog

In Splunk AI Toolkit versions below 6.0.0, a user without "admin" or "power" roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The vulnerability is due to replacing the calling user session key with a system authentication token before performing search operations.

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on REST API endpoints and authentication model.

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment REST API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance.

In Splunk Enterprise Security versions below 8.6.1, a user with the ess_analyst role could change UEBA search macros that scheduled searches run with administrator permissions, allowing for access to all relevant data and system integrity through those searches. The vulnerability is due to granting analyst roles write access to search macros that should be writable only by administrator roles.

In Splunk Enterprise Security versions below 8.6.1, a user with a role containing the mc_investigation_read capability could inject SPL through Analyst Queue search filters, allowing for access to all relevant data and system integrity available to the scheduled searches that run for that user. The vulnerability is due to lack of validation of filter field names before they are included in SPL searches.

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and pmi_password parameters are not masked and are shown in cleartext in the user interface.

In versions below 2.1.4 of the Venafi app for Splunk SOAR, a user who holds a role with permission to run actions could expose keystore and private-key passwords by invoking the get certificate action, because the action's keystore_password and password parameters are not masked and are shown in cleartext in the user interface.

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archive_password parameter is not masked and is shown in cleartext in the user interface.

In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's token_serial parameter is not masked and is shown in cleartext in the user interface.

In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action's password parameter is not masked and is shown in cleartext in the user interface.

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user with permission to run actions could expose a sensitive password by invoking the reset password action, because the temp_password parameter is not masked and is shown in cleartext in the UI. This is possible because the app does not mark the parameter as a password.

In versions below 5.1.3 of the CrowdStrike OAuth API app for Splunk SOAR, a user with permission to run actions could expose a sensitive document password by invoking detonate file or detonate url actions, because the document_password parameter is not masked and is shown in cleartext in the UI. This is possible because the app does not mark the parameter as a password.

In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the password parameter is not masked and is shown in cleartext in the UI. This is possible because the app does not mark the parameter as a password.

In versions below 2.4.5 of the Cisco Secure Malware Analytics app for Splunk SOAR, a user with permission to run actions could expose a sensitive sample password by invoking the detonate file action, because the sample_password parameter is not masked and is shown in cleartext in the UI. This is possible because the app does not mark the parameter as a password.

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user with permission to run actions could expose a sensitive password by invoking the reset password action, because the temp_password parameter is not masked and is shown in cleartext in the UI. This is possible because the app does not mark the parameter as a password.

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the UI. This is possible because the app does not mark the parameter as a password.

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext.

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app.

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user with permission to run actions could inject crafted input into an Active Directory query to enumerate Active Directory objects, including accounts, groups, and organizational units, read sensitive attributes from arbitrary directory objects, and redirect account modification actions to unintended objects.

In Nmap Scanner versions below 3.0.15, a user with a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the action manifest classifies the action as read-only even though it accepts script parameters that can perform write operations.