CVE-2023-3997

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://advisory.splunk.com/advisories/SVD-2023-0702	Vendor Advisory
https://advisory.splunk.com/advisories/SVD-2023-0702	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:splunk:soar:::::on-premises:::*
	cpe:2.3:a:splunk:soar:::::cloud:::*

History

10 Dec 2024, 18:15

Type	Values Removed	Values Added
Summary	(en) Splunk SOAR versions 6.0.2 and earlier are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.	(en) Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.

21 Nov 2024, 08:18

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 8.6
References	~~() https://advisory.splunk.com/advisories/SVD-2023-0702 - Vendor Advisory~~	() https://advisory.splunk.com/advisories/SVD-2023-0702 - Vendor Advisory

15 Oct 2024, 19:15

Type	Values Removed	Values Added
Summary	(en) Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.	(en) Splunk SOAR versions 6.0.2 and earlier are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.

19 Aug 2023, 01:15

Type	Values Removed	Values Added
Summary	Splunk SOAR versions 6.0.2 and earlier are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.	Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.

04 Aug 2023, 17:09

Type	Values Removed	Values Added
CPE		cpe:2.3:a:splunk:soar:::::on-premises:::* cpe:2.3:a:splunk:soar:::::cloud:::*
References	~~(MISC) https://advisory.splunk.com/advisories/SVD-2023-0702 -~~	(MISC) https://advisory.splunk.com/advisories/SVD-2023-0702 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
CWE		CWE-74

31 Jul 2023, 17:30

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-07-31 17:15

Updated : 2024-12-10 18:15

NVD link : CVE-2023-3997

Mitre link : CVE-2023-3997

CVE.ORG link : CVE-2023-3997

JSON object : View

Products Affected

splunk

soar

CWE

CWE-117

Improper Output Neutralization for Logs

CWE-116

Improper Encoding or Escaping of Output

8.6 /10