CyberRota Analysis
AI-GeneratedIn Splunk SOAR versions prior to 8.6.0, users with the "Automation Engineer" role can exploit a SQL injection vulnerability to execute arbitrary SQL statements against the Splunk SOAR database, potentially compromising data integrity and exposing sensitive information. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data access and ensure the security of their systems.
Original NVD Description
In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements against the Splunk SOAR database through custom function results, allowing for reading all relevant data stored in the Splunk SOAR database and affecting system integrity. The SQL injection is possible because Splunk SOAR builds the database lookup with the supplied name instead of a bound SQL value. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)