In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, the credentials parameter in certain actions is not masked and is displayed in cleartext in the user interface. Users with roles that permit running actions can therefore expose sensitive AWS credentials. The root cause is that the affected action parameter is not marked as a password field, resulting in unmasked display of sensitive information. This vulnerability is specific to the AWS IAM app integrated with Splunk SOAR and impacts cloud service deployments.

The vulnerability can lead to the exposure of sensitive AWS credentials to users who have permission to run actions within the app. This information disclosure could potentially allow unauthorized access to AWS resources if the credentials are misused. However, the impact is limited to confidentiality as there is no indication of integrity or availability impact. The CVSS score of 4.3 reflects a medium severity level.

A patch is available for this vulnerability in versions 2.1.9 and later of the AWS IAM app for Splunk SOAR. Since this is a cloud service, the vendor typically manages remediation server-side. Users should verify with Splunk's official advisory or support channels to confirm that their instance is updated to a fixed version or that the issue has been mitigated. No additional action is required if the environment is already running a patched version or if the vendor has applied the fix in the cloud service.