Fireamp
Monthly
FireAMP connector versions below 2.1.15 for Splunk SOAR allow authenticated playbook editors to bypass Safe Mode restrictions by invoking the add listitem action, which the connector manifest incorrectly classifies as read-only despite it performing write operations on file lists. Exploitation requires a high-privilege role (playbook edit/create/run), limiting the attack surface to trusted internal SOAR users. No public exploit code exists and this vulnerability has not been identified in CISA KEV, consistent with its low CVSS score of 2.7.
FireAMP connector versions below 2.1.15 for Splunk SOAR allow authenticated playbook editors to bypass Safe Mode restrictions by invoking the add listitem action, which the connector manifest incorrectly classifies as read-only despite it performing write operations on file lists. Exploitation requires a high-privilege role (playbook edit/create/run), limiting the attack surface to trusted internal SOAR users. No public exploit code exists and this vulnerability has not been identified in CISA KEV, consistent with its low CVSS score of 2.7.