CVE-2023-3997
High
Description
Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.
SeverityHigh
CVSS8.6
Exploit probability—
ProductSplunk Soar
PublishedJul 31, 2023
First seenJul 31, 2023
Weakness typeCWE-117CWE-117
How to fix
Update
- splunk soar6.1.0, 6.1.0.131 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| splunk soar | v < 6.1.0, v < 6.1.0.131 | 6.1.0, 6.1.0.131 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.