CVE-2025-22621 MEDIUM

CVE-2025-22621: Privilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOAR

Vendor Splunk
Product Splunk App for SOAR
Weakness CWE-269
Published January 7, 2025
Last update February 28, 2025
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles.

Key dates

02Disclosure timeline

January 7, 2025 CVE published
February 28, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-23537 Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role. CVE-2023-7016 Privilege Escalation in SafeNet Authentication Client CVE-2020-26063 Cisco Integrated Management Controller Software Authorization Bypass Vulnerability CVE-2024-8424 WatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEM CVE-2025-7341 HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion