In Splunk Attack Analyzer Connector for Splunk SOAR versions prior to 2.2.1, the archive_password parameter used in the detonate file and detonate url actions is exposed in cleartext to users who have roles permitting them to run these actions. This is due to the parameter not being designated as a password field, resulting in sensitive information being displayed unmasked in the user interface. The vulnerability is identified as CWE-312 (Cleartext Storage of Sensitive Information).

The vulnerability allows users with action execution permissions to view sensitive archive passwords in cleartext within the user interface. This information disclosure could lead to unauthorized access if the exposed password is reused or leveraged in other contexts. There is no indication of impact on integrity or availability. The CVSS score is 4.3 (medium severity), reflecting a network attack vector with low complexity and requiring privileges to run actions.

A fix is available in version 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, which addresses the issue by properly masking the archive_password parameter. Users should upgrade to version 2.2.1 or later to remediate this vulnerability. Until then, restrict roles with permission to run actions to trusted users only. Patch status is not explicitly confirmed in the input data, so verify the vendor advisory for the latest remediation guidance.