Cisco Secure Malware Analytics App For Splunk Soar
Monthly
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.
Cleartext exposure of a sensitive sample password in the Cisco Secure Malware Analytics App for Splunk SOAR (versions below 2.4.5) allows authenticated users with action-run permissions to read the sample_password parameter value directly from the Splunk SOAR user interface. The root cause is the app's failure to mark the sample_password field as a password type in the detonate file action, meaning the platform never applies its standard masking behavior to that parameter. No public exploit code or active exploitation has been identified; vendor patch is available at version 2.4.5.