CyberRota Analysis
AI-GeneratedIn Splunk SOAR versions prior to 8.6.0, users with the "Automation Engineer" role can exploit a SQL injection vulnerability through custom list retrieval in playbooks, enabling them to execute arbitrary SQL commands that can manipulate the database. This flaw allows for unauthorized create, read, update, and delete operations on all data within the Splunk SOAR database. Organizations using affected versions should prioritize patching to mitigate potential data breaches and unauthorized access.
Original NVD Description
In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom list retrieval in a playbook, allowing for create, read, update, and delete operations on all relevant data stored in the Splunk SOAR database. The SQL injection is possible because Splunk SOAR builds the custom list database lookup with the supplied list name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and Create custom lists for use in Splunk SOAR playbook comparisons (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/create-custom-lists-for-use-in-splunk-soar-cloud-playbook-comparisons) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)