Rsa Securid Authentication Manager App For Splunk Soar
Monthly
Information disclosure in the RSA SecurID Authentication Manager app for Splunk SOAR (versions below 1.0.5) exposes RSA token serial numbers in cleartext to any authenticated user with action-run permissions. The app's 'enable token' and 'revoke token' actions fail to mark the token_serial parameter as a password field, causing it to render unmasked in the Splunk SOAR user interface. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for an existing Splunk SOAR account with action-execution privileges.
Information disclosure in the RSA SecurID Authentication Manager app for Splunk SOAR (versions below 1.0.5) exposes RSA token serial numbers in cleartext to any authenticated user with action-run permissions. The app's 'enable token' and 'revoke token' actions fail to mark the token_serial parameter as a password field, causing it to render unmasked in the Splunk SOAR user interface. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for an existing Splunk SOAR account with action-execution privileges.