Read the docs
TI-2023-03711 Aliases CVE-2023-3997GHSA-48g5-4ph9-jjmf

Unauthenticated Log Injection In Splunk SOAR

Priority LOW 37CWE-117Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to view the poisoned logs, this can tamper with the terminal and cause possible malicious code execution from the terminal user’s action.

Why it matters now

EPSS 0.00286 21st percentileScored 2026-11-07
Fix Fixed Splunk SOAR (On-premises) (Splunk): 6.1.0Splunk SOAR (Cloud) (Splunk): 6.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SplunkSplunk SOAR (On-premises)- to before 6.1.06.1.0Patch availableCNA
SplunkSplunk SOAR (Cloud)- to before 6.1.06.1.0Patch availableCNA
  • Splunk SOAR (On-premises) VendorSplunk Affected - to before 6.1.0 Fixed in 6.1.0 Patch available CNA
  • Splunk SOAR (Cloud) VendorSplunk Affected - to before 6.1.0 Fixed in 6.1.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:splunk:soar:*:*:*:*:on-premises:*:*:*before 6.1.0VulnerableSplunk
cpe:2.3:a:splunk:soar:*:*:*:*:cloud:*:*:*before 6.1.0.131VulnerableSplunk
  • cpe:2.3:a:splunk:soar:*:*:*:*:on-premises:*:*:* Versions before 6.1.0 Vulnerable ·Splunk
  • cpe:2.3:a:splunk:soar:*:*:*:*:cloud:*:*:* Versions before 6.1.0.131 Vulnerable ·Splunk

Remediation

  • Fix · CNA Splunk SOAR (On-premises) (Splunk) Fixed in 6.1.0
  • Fix · CNA Splunk SOAR (Cloud) (Splunk) Fixed in 6.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3997
  2. 2026-10-03 Alias added: GHSA-48g5-4ph9-jjmf

References

Advisory 1

  • TI-2026-53411 Authentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAR CVSS 3.1HIGH 8.1
  • TI-2026-53417 Improper Certificate Validation through CyberArk Vault Privileged Access Manager in Splunk SOAR CVSS 3.1HIGH 7.4
  • TI-2026-53412 Remote Code Execution (RCE) through Path Traversal in the REST API in Splunk SOAR CVSS 3.1HIGH 7.6
  • TI-2026-53420 Structured Query Language (SQL) Injection through Custom Lists in Splunk SOAR CVSS 3.1MEDIUM 6.5
  • TI-2026-53419 Structured Query Language (SQL) Injection through Custom Function Results in Splunk SOAR CVSS 3.1MEDIUM 6.5
  • TI-2026-53418 Structured Query Language Injection through the REST API in Splunk SOAR CVSS 3.1MEDIUM 6.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences