CVE-2023-0002

2023-02-0818:15:11

CWE-693

[email protected]

web.nvd.nist.gov

vulnerability

palo alto networks

cortex xdr

agent

local user

privileged commands

nvd

cve-2023-0002

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.

Affected configurations

NVD

Node

paloaltonetworkscortex_xdr_agentRange5.0–5.0.12.22203

paloaltonetworkscortex_xdr_agentRange7.5–7.5.101critical_environment

AND

microsoftwindowsMatch-

CPENameOperatorVersion
paloaltonetworks:cortex_xdr_agentpaloaltonetworks cortex xdr agentlt5.0.12.22203
paloaltonetworks:cortex_xdr_agentpaloaltonetworks cortex xdr agentle7.5.101

CPE	Name	Operator	Version
paloaltonetworks:cortex_xdr_agent	paloaltonetworks cortex xdr agent	lt	5.0.12.22203
paloaltonetworks:cortex_xdr_agent	paloaltonetworks cortex xdr agent	le	7.5.101

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Cortex XDR agent",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "7.9 All"
      },
      {
        "status": "unaffected",
        "version": "7.8 All"
      },
      {
        "changes": [
          {
            "at": "7.5.101-CE",
            "status": "unaffected"
          }
        ],
        "lessThan": "7.5.101-CE",
        "status": "affected",
        "version": "7.5",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "5.0.12.22203",
            "status": "unaffected"
          }
        ],
        "lessThan": "5.0.12.22203",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      }
    ]
  }
]