CVE-2023-3997: Unauthenticated Log Injection In Splunk SOAR
Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.
Other sources
Splunk SOAR versions 6.0.2 and earlier are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Splunk SOAR vulnerability?
The vulnerability ID for this Splunk SOAR vulnerability is CVE-2023-3997.
What is the severity level of CVE-2023-3997?
The severity level of CVE-2023-3997 is high (7.8).
What is the affected software for CVE-2023-3997?
The affected software for CVE-2023-3997 is Splunk SOAR versions 6.0.2 and earlier (on-premises and cloud).
How can this vulnerability be exploited?
This vulnerability can be exploited by sending Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning.
Is there a fix available for CVE-2023-3997?
Yes, updating to Splunk SOAR version 6.1.0 or higher will fix the vulnerability.