Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.
References
| Link | Resource |
|---|---|
| https://advisory.splunk.com/advisories/SVD-2023-0702 | Vendor Advisory |
| https://advisory.splunk.com/advisories/SVD-2023-0702 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
10 Dec 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action. |
Information
Published : 2023-07-31 17:15
Updated : 2024-12-10 18:15
NVD link : CVE-2023-3997
Mitre link : CVE-2023-3997
CVE.ORG link : CVE-2023-3997
JSON object : View
Products Affected
splunk
- soar