In the AD LDAP app for Splunk SOAR versions =2.3, a user role permitted to run actions can trigger write operations that cause sensitive Active Directory response data to be logged persistently in debug files. This logging behavior can expose sensitive information that may aid an attacker or leak user data. The vulnerability is limited to information disclosure via log files and does not affect system integrity or availability. No official remediation or patch is currently documented, and no known exploits are reported in the wild.

The vulnerability results in the exposure of sensitive Active Directory response data through persistent debug log files. This information disclosure could assist an attacker in understanding the environment or accessing sensitive user information. There is no impact on system integrity or availability. The CVSS score of 4.3 reflects a medium severity primarily due to the confidentiality impact with network attack vector and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to run actions in the AD LDAP app to trusted users only to minimize risk of sensitive data exposure in logs.