PT-2025-4607 · Splunk · Splunk App For Soar

Gabriel Nitu

·

Published

2025-01-07

·

Updated

2025-01-15

·

CVE-2025-22621

CVSS v2.0

6.6

Medium

VectorAV:N/AC:H/Au:S/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions Splunk App for SOAR versions 1.0.67 and lower
Description The issue is related to improper access control. In the affected versions of the Splunk App for SOAR, the documentation recommended adding the admin all objects capability to the splunk app soar role. This could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles.
Recommendations For versions 1.0.67 and lower, remove the admin all objects capability from the splunk app soar role to prevent improper access control. As a temporary workaround, consider restricting the splunk app soar role to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2025-02663
CVE-2025-22621

Affected Products

Splunk App For Soar