What is the vulnerability ID for this Splunk SOAR vulnerability?

The vulnerability ID for this Splunk SOAR vulnerability is CVE-2023-3997.

What is the severity level of CVE-2023-3997?

The severity level of CVE-2023-3997 is high (7.8).

What is the affected software for CVE-2023-3997?

The affected software for CVE-2023-3997 is Splunk SOAR versions 6.0.2 and earlier (on-premises and cloud).

Is there a fix available for CVE-2023-3997?

Yes, updating to Splunk SOAR version 6.1.0 or higher will fix the vulnerability.

Vulnerability/
CVE-2023-3997

high

8.6

CWE

117 116 74

31/7/2023

30/10/2024

CVE-2023-3997: Unauthenticated Log Injection In Splunk SOAR

Q: How can this vulnerability be exploited?

This vulnerability can be exploited by sending Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning.

First published: Mon Jul 31 2023(Updated: )

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.

Credit: prodsec@splunk.com prodsec@splunk.com

Affected Software	Affected Version	How to fix
Splunk SOAR	<6.1.0.131
Splunk SOAR	<6.1.0
	<6.1.0
	<6.1.0.131

Never miss a vulnerability like this again

Reference Links

https://advisory.splunk.com/advisories/SVD-2023-0702

Frequently Asked Questions

What is the vulnerability ID for this Splunk SOAR vulnerability?
The vulnerability ID for this Splunk SOAR vulnerability is CVE-2023-3997.
What is the severity level of CVE-2023-3997?
The severity level of CVE-2023-3997 is high (7.8).
What is the affected software for CVE-2023-3997?
The affected software for CVE-2023-3997 is Splunk SOAR versions 6.0.2 and earlier (on-premises and cloud).
How can this vulnerability be exploited?
This vulnerability can be exploited by sending Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning.
Is there a fix available for CVE-2023-3997?
Yes, updating to Splunk SOAR version 6.1.0 or higher will fix the vulnerability.

collector/nvd-latest
collector/nvd-index
agent/type
agent/first-publish-date
agent/author
agent/softwarecombine
agent/description
agent/weakness
agent/title
agent/references
agent/severity
agent/event
agent/tags
agent/last-modified-date
collector/mitre-cve
source/MITRE
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/splunk
canonical/splunk soar

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.