CyberRota Analysis
AI-GeneratedIn Splunk SOAR versions prior to 8.6.0, an authenticated user lacking a designated role can exploit a missing authorization check in the /rest/health endpoint to access sensitive system and cluster telemetry data. This could lead to unauthorized exposure of critical operational information, potentially aiding malicious actors in planning further attacks. Organizations using affected versions should prioritize patching to mitigate this risk, particularly those with users who may have limited access controls.
Original NVD Description
In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry that should be restricted to administrative or support users. The vulnerability is a missing authorization check, where the endpoint does not verify that the caller holds a role permitted to view system health and cluster state. For more information see Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) and Monitor the health of your Splunk SOAR (On-premises) system (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-system-health-and-performance/monitor-the-health-of-your-splunk-soar-on-premises-system) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)