CyberRota Analysis
AI-GeneratedSplunk SOAR versions prior to 8.6.0 are vulnerable to an attack where an unauthenticated user can intercept network traffic between Splunk SOAR and a CyberArk REST server, allowing unauthorized access to or modification of sensitive data. This vulnerability arises from the CyberArk REST client’s failure to verify server certificates by default, necessitating network-path interception capabilities for exploitation. Organizations using affected versions of Splunk SOAR should prioritize immediate updates to mitigate potential data breaches.
Original NVD Description
In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack requires the attacker to have network-path interception capability between Splunk SOAR and the configured CyberArk REST server. For more information see Manage your organization's credentials with a password vault (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/configure-administration-settings-in-splunk-soar-cloud/manage-your-organizations-credentials-with-a-password-vault) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)