Lucene search

[email protected]CVE-2024-5907

HistoryJun 12, 2024 - 5:15 p.m.

CVE-2024-5907

2024-06-1217:15:53

CWE-269

[email protected]

web.nvd.nist.gov

cve-2024-5907

privilege escalation

palo alto networks

cortex xdr agent

windows

local user

elevated privileges

race condition

difficult to exploit

5.2 Medium

CVSS4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/SC:H/VI:L/SI:H/VA:N/SA:H/AU:N/U:Amber/R:U/V:D/RE:M

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully exploit a race condition, which makes this vulnerability difficult to exploit.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Cortex XDR Agent",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "changes": [
          {
            "at": "7.9.102-CE",
            "status": "unaffected"
          }
        ],
        "lessThan": "7.9.102-CE",
        "status": "affected",
        "version": "7.9-CE",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "8.1.0"
      },
      {
        "changes": [
          {
            "at": "8.2.3",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.2.3",
        "status": "affected",
        "version": "8.2.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "8.3.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.3.1",
        "status": "affected",
        "version": "8.3.0",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "8.4.0"
      }
    ]
  }
]

References

security.paloaltonetworks.com/CVE-2024-5907