Unauthenticated Log Injection In Splunk SOAR

CVE-2023-3997

What is CVE-2023-3997?

Splunk SOAR prior to version 6.1.0 is vulnerable to a log file poisoning attack. An attacker can exploit this vulnerability by sending a specially crafted web request containing specific ANSI characters. This can lead to the manipulation of log files, affecting terminal users who attempt to view these compromised logs. As a result, terminal users may inadvertently execute malicious code, posing significant risks to the security and integrity of the system. Users are encouraged to upgrade to the latest version to mitigate these risks. For more detailed information, please refer to the Splunk advisory.

References