Google Secops Chronicle Soar
Monthly
Blind SQL injection in Google SecOps (Chronicle SOAR) versions before 6.3.85 lets an authenticated user abuse a crafted request parameter in a legacy dashboard widget API to run arbitrary blind SQL queries against the backend database. CVSS 4.0 rates it 9.4 (critical) with a low-privilege network vector; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Because the platform is a Google Cloud-managed SaaS, the fix was deployed by the vendor and no customer action is required.
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.
Blind SQL injection in Google SecOps (Chronicle SOAR) versions before 6.3.85 lets an authenticated user abuse a crafted request parameter in a legacy dashboard widget API to run arbitrary blind SQL queries against the backend database. CVSS 4.0 rates it 9.4 (critical) with a low-privilege network vector; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Because the platform is a Google Cloud-managed SaaS, the fix was deployed by the vendor and no customer action is required.
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.