« Volver al listado

CVE-2025-22621

Estado: AplazadaMedia (6.4)—

In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Splunk — APP FOR SoarAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-22621",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-22621",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-07T18:19:48.408775Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "prodsec@splunk.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "prodsec@splunk.com",
      "affectedData": [
        {
          "vendor": "Splunk",
          "product": "Splunk App for SOAR",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "lessThan": "1.0.71",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-01-07T17:15:35.710",
  "references": [
    {
      "url": "https://advisory.splunk.com/advisories/SVD-2025-0101",
      "source": "prodsec@splunk.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "prodsec@splunk.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileged user that does not hold the \"admin\"  Splunk roles."
    },
    {
      "lang": "es",
      "value": "En las versiones 1.0.67 y anteriores de Splunk App para SOAR, la documentación de Splunk para esa aplicación recomendaba agregar la capacidad `admin_all_objects` al rol `splunk_app_soar`. Esta adición podría generar un control de acceso inadecuado para un usuario con poco nivel de privilegios que no tenga el rol de Splunk de \"administrador\"."
    }
  ],
  "lastModified": "2026-06-17T08:48:46.670",
  "sourceIdentifier": "prodsec@splunk.com"
}