Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) Vulnerability (Palo Alto Networks Cortex XDR Agent)
En bref
- Source
- NVD
- EPSS
- EPSS 0.23 % · centile 13 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- palo_alto
- Statut NVD
- Modified
Description
A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version.
Faiblesses (CWE)
- CWE-282 — Improper Ownership Management
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | palo_alto |
| CVSS 3.1 | MEDIUM 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-15247
- GCVE · GCVE-0-2022-0026
Avis du CERT-FR
- CERTFR-2022-AVI-455 — Multiples vulnérabilités dans les produits Palo Alto Networks · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.4:hotfix:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.5:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.5:hotfix:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.6:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.7:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.8:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.9:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.1:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.2:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.3:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.4:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5:-:*:*:content_engine:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.1:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.2:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.3:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.6.1:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.6.2:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.7:-:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.7.1:-:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Palo Alto Networks · Cortex XDR Agent | affected 7.7.* without CU-330 ; unaffected 7.7.* with CU-330 ; affected 7.6.* without CU-330 ; unaffected 7.6.* with CU-330 ; affected 7.5 CE 7.5.* without CU-330 ; unaffected 7.5 CE 7.5.* with CU-330 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |