EUVD-2026-62949
GHSA-6cqf-6324-39pj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires low-privilege authenticated access with a specific action-running role; confidentiality impact is limited to one credential value; no integrity or availability impact applies.
Primary rating from Vendor (cisco).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archive_password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
AnalysisAI
Cleartext exposure of archive passwords in Splunk Attack Analyzer Connector for Splunk SOAR (versions below 2.2.1) allows authenticated users with action-running permissions to view sensitive archive_password values unmasked in the SOAR user interface. The connector's detonate file and detonate url actions fail to mark the archive_password parameter as a password type, causing the SOAR framework to render it in plaintext during and after action execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following must be present: an authenticated Splunk SOAR account with a role explicitly granted the 'run actions' permission; the Splunk Attack Analyzer Connector (version below 2.2.1) installed and configured on the SOAR instance; and the detonate file or detonate url action must be invoked with an archive_password parameter value supplied. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 (Medium) score accurately reflects the narrow scope: a low-privileged, network-accessible, authenticated user can read a sensitive credential that should be masked, with no integrity or availability impact and no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Splunk SOAR operator with a role that grants 'run actions' permission invokes either the detonate file or detonate url action via the Splunk Attack Analyzer Connector, supplying an archive password for a protected submission file. Because the parameter is not masked, the password appears in plaintext in the action's parameter view within the SOAR UI, making it readable to any user who can access that action's execution record - including other operators sharing the workspace or anyone with access to SOAR action history. |
| Remediation | Upgrade the Splunk Attack Analyzer Connector for Splunk SOAR to version 2.2.1 or later, which resolves the issue by properly designating the archive_password parameter as a password field so the SOAR platform masks it in the UI and execution logs. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Directory traversal vulnerability in the collect script in Splunk before 5.0.5 allows remote attackers to execute arbitr
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today