InfoSecBulletin Cybersecurity for mankind
Splunk has issued critical security updates for SOAR versions 6.4.0 and 6.4 to fix several vulnerabilities in third-party packages. The comprehensive security update published on July 7, 2025, fixes several Common Vulnerabilities and Exposures (CVEs) with severity levels from medium to critical.
Critical vulnerabilities impact core components like git, Django, cryptography libraries, and JavaScript packages, necessitating urgent action from security admins overseeing Splunk SOAR deployments.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
Key Takeaways:
Splunk addresses multiple critical CVEs including CVE-2024-32002 (git) and CVE-2024-48949 (@babel/traverse) in SOAR versions 6.4.0 and 6.4.
Third-party components upgraded, including Django, cryptography, jQuery DataTables, and wkhtml removal, covering vulnerabilities from critical to medium severity
All SOAR 6.4 installations below version 6.4.1 must immediately upgrade to 6.4.1 orhigher
Unpatched vulnerabilities could enable unauthorized access, code execution, and data manipulation across the core SOAR infrastructure.
Critical Vulnerabilities Addressed:
The security advisory highlights critical vulnerabilities that pose immediate risks to SOAR environments. CVE-2024-32002 is a critical vulnerability in the git package found in Splunk SOAR versions 6.4.0 and 6.4.1. Upgrading to git version 2.48.1 resolves the issue.
The critical severity rating shows that this vulnerability is a serious security risk and needs prompt action from system administrators. CVE-2024-48949 represents another critical severity vulnerability, specifically targeting the @babel/traverse package.
In Splunk SOAR 6.4.0, the vulnerability was fixed by upgrading to version 7.26.7.
High-Severity Issues:
High-severity vulnerabilities include CVE-2024-45230 in Django, CVE-2024-21538 in cross-spawn, CVE-2024-52804 in tornado, CVE-2022-35583 wkhtml vulnerability, CVE-2024-6345 in Setuptools, CVE-2024-39338 in Axios JavaScript library and CVE-2024-49767 in Werkzeug WSGI utility library.
These vulnerabilities could potentially allow unauthorized access, code execution, or data manipulation within the SOAR environment.
Organizations must immediately upgrade to Splunk SOAR version 6.4.1 or higher to remediate all identified vulnerabilities.
The advisory affects all SOAR base version 6.4 installations below 6.4.1, making this update essential for maintaining security posture.
