Lucene search

SplunkCVELIST:CVE-2023-3997

HistoryJul 31, 2023 - 4:16 p.m.

CVE-2023-3997 Unauthenticated Log Injection In Splunk SOAR

2023-07-3116:16:19

Splunk

www.cve.org

splunk soar

log injection

unauthenticated

vulnerability

ansi characters

code execution

CVSS3

8.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

23.1%

JSON

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.

CNA Affected

[
  {
    "product": "Splunk SOAR (On-premises)",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "-",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "6.1.0"
      }
    ]
  },
  {
    "product": "Splunk SOAR (Cloud)",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "-",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "6.1.0"
      }
    ]
  }
]

References

advisory.splunk.com/advisories/SVD-2023-0702

CVSS3

8.6

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

23.1%

JSON

Related for CVELIST:CVE-2023-3997