CyberRota Analysis
AI-GeneratedIn Splunk SOAR versions prior to 8.6.0, users with the "Automation Engineer" role can execute arbitrary SQL statements against the database, allowing them to manipulate all data—create, read, update, or delete—due to insufficient input validation in the playbook automation data APIs. This vulnerability poses a risk of unauthorized data access and manipulation, making it critical for organizations using affected versions to prioritize an upgrade to mitigate potential data breaches. Security teams and database administrators should address this issue promptly to safeguard sensitive information.
Original NVD Description
In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database and create, read, update, or delete all data in the database. The vulnerability is possible because Splunk SOAR playbook automation data APIs incorporate user-supplied input into database queries without proper neutralization. For more information see Manage roles and permissions in Splunk SOAR Cloud (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)