Description

In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the action's password parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:23.950Z",
  "pubdate": "2026-08-19T22:17:23.950Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, specifically within the schedule meeting action. The flaw allows a user with permissions to execute SOAR actions to expose sensitive meeting passwords in cleartext via the user interface. This occurs because the application fails to properly designate the affected action parameter as a password field, preventing automatic masking by the platform.\nThe risk implication involves the unauthorized exposure of confidential meeting credentials to authenticated operators within the Splunk SOAR interface. Attacker capabilities are restricted to users holding roles with permissions to run actions, who can leverage the interface rendering behavior to extract cleartext passwords. Exploitation requires authenticated access to the Splunk SOAR platform and the specific privileges necessary to invoke the schedule meeting action.",
  "technicalDetails": "The root cause of this information disclosure vulnerability is the improper configuration of the action parameter metadata within the Cisco Webex app for Splunk SOAR. Specifically, the vulnerable component is the schedule meeting action parameter definition, which fails to mark the meeting password parameter as a sensitive data type or password field.\nAuthentication and privilege requirements dictate that the user must hold a role with explicit permissions to run actions within the Splunk SOAR environment. The vulnerability is exposed directly through the user interface when the action is invoked. Because the parameter lacks the internal classification required to trigger masking mechanisms, the platform renders the input and output values of the password parameter in cleartext.\nThe attack flow begins when an authorized operator initiates the schedule meeting action through the Splunk SOAR interface. As the action executes and processes the parameters, the application processes the cleartext password parameter without applying UI-level obscuration or encryption during rendering. Consequently, any user with interface access to view the action execution details and parameter history can observe the sensitive meeting password in plain text.\nThe affected versions include all releases of the Cisco Webex app for Splunk SOAR prior to version 2.2.1. Post-exploitation impact is constrained to the confidentiality breach of meeting credentials generated during the vulnerable action execution, potentially allowing unauthorized access to Cisco Webex meetings associated with the exposed passwords."
}