Ad Ldap App For Splunk Soar
Monthly
Credential exposure in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows any authenticated user holding an action-execution role to trigger a full connector process environment dump to a persistent plaintext debug log file, disclosing sensitive credentials such as LDAP bind secrets or service account tokens. The CVSS scope-changed vector (S:C) reflects that the exposed credentials extend impact beyond the SOAR platform itself to the underlying Active Directory environment. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis; however, patch version 2.3.8 is available and should be applied promptly given the potential for AD credential theft.
Sensitive Active Directory response data exposure in the AD LDAP App for Splunk SOAR (versions below 2.3.8) allows authenticated users holding action-execution permissions to cause AD directory data to be written to a persistent debug log file. The flaw is rooted in CWE-532 (insertion of sensitive information into log files) and is reachable over the network by any low-privileged SOAR user with the appropriate role. No public exploit code or active exploitation has been identified; Splunk has released a patch at version 2.3.8.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exposure in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows any authenticated user holding an action-execution role to trigger a full connector process environment dump to a persistent plaintext debug log file, disclosing sensitive credentials such as LDAP bind secrets or service account tokens. The CVSS scope-changed vector (S:C) reflects that the exposed credentials extend impact beyond the SOAR platform itself to the underlying Active Directory environment. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis; however, patch version 2.3.8 is available and should be applied promptly given the potential for AD credential theft.
Sensitive Active Directory response data exposure in the AD LDAP App for Splunk SOAR (versions below 2.3.8) allows authenticated users holding action-execution permissions to cause AD directory data to be written to a persistent debug log file. The flaw is rooted in CWE-532 (insertion of sensitive information into log files) and is reachable over the network by any low-privileged SOAR user with the appropriate role. No public exploit code or active exploitation has been identified; Splunk has released a patch at version 2.3.8.
LDAP injection in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows authenticated low-privileged users to manipulate Active Directory queries, exposing account enumeration, sensitive attribute disclosure, and unintended modification of AD objects. Exploitation requires only a role with 'run actions' permission within Splunk SOAR - no elevated SOAR admin rights needed. Splunk has released a patch (version 2.3.8); no public exploit code or CISA KEV listing has been identified at time of analysis.