InfoSecBulletin Cybersecurity for mankind
Splunk has issued critical security updates for SOAR versions 6.4.0 and 6.4 to fix several vulnerabilities in third-party packages. The comprehensive security update published on July 7, 2025, fixes several Common Vulnerabilities and Exposures (CVEs) with severity levels from medium to critical.
Critical vulnerabilities impact core components like git, Django, cryptography libraries, and JavaScript packages, necessitating urgent action from security admins overseeing Splunk SOAR deployments.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
Key Takeaways:
Splunk addresses multiple critical CVEs including CVE-2024-32002 (git) and CVE-2024-48949 (@babel/traverse) in SOAR versions 6.4.0 and 6.4.
Third-party components upgraded, including Django, cryptography, jQuery DataTables, and wkhtml removal, covering vulnerabilities from critical to medium severity
All SOAR 6.4 installations below version 6.4.1 must immediately upgrade to 6.4.1 orhigher
Unpatched vulnerabilities could enable unauthorized access, code execution, and data manipulation across the core SOAR infrastructure.
Critical Vulnerabilities Addressed:
The security advisory highlights critical vulnerabilities that pose immediate risks to SOAR environments. CVE-2024-32002 is a critical vulnerability in the git package found in Splunk SOAR versions 6.4.0 and 6.4.1. Upgrading to git version 2.48.1 resolves the issue.
The critical severity rating shows that this vulnerability is a serious security risk and needs prompt action from system administrators. CVE-2024-48949 represents another critical severity vulnerability, specifically targeting the @babel/traverse package.
In Splunk SOAR 6.4.0, the vulnerability was fixed by upgrading to version 7.26.7.
High-Severity Issues:
High-severity vulnerabilities include CVE-2024-45230 in Django, CVE-2024-21538 in cross-spawn, CVE-2024-52804 in tornado, CVE-2022-35583 wkhtml vulnerability, CVE-2024-6345 in Setuptools, CVE-2024-39338 in Axios JavaScript library and CVE-2024-49767 in Werkzeug WSGI utility library.
These vulnerabilities could potentially allow unauthorized access, code execution, or data manipulation within the SOAR environment.
Organizations must immediately upgrade to Splunk SOAR version 6.4.1 or higher to remediate all identified vulnerabilities.
The advisory affects all SOAR base version 6.4 installations below 6.4.1, making this update essential for maintaining security posture.
