CyberRota Analysis
AI-GeneratedThe RSA SecurID Authentication Manager app for Splunk SOAR versions prior to 1.0.5 exposes sensitive token serials in cleartext through the token_serial parameter when executing enable or revoke token actions. This information disclosure could allow unauthorized users to access sensitive authentication tokens, potentially compromising security. Organizations utilizing this app should prioritize upgrading to the latest version to mitigate the risk of sensitive data exposure.
Original NVD Description
In versions below 1.0.5 of the RSA SecurID Authentication Manager app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive token serial by invoking either the enable token or revoke token action, because the action's token_serial parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).