Lucene search

K
cvelistPalo_altoCVELIST:CVE-2022-0029
HistorySep 14, 2022 - 4:35 p.m.

CVE-2022-0029 Cortex XDR Agent: Improper Link Resolution Vulnerability When Generating a Tech Support File

2022-09-1416:35:08
CWE-59
palo_alto
www.cve.org
4
cortex xdr
improper link resolution
vulnerability
windows devices
local attacker
elevated privileges
tech support file

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

5.1%

An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.

CNA Affected

[
  {
    "platforms": [
      "Windows"
    ],
    "product": "Cortex XDR Agent",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "lessThan": "7.7.3",
        "status": "affected",
        "version": "7.7",
        "versionType": "custom"
      },
      {
        "lessThan": "7.5.101-CE",
        "status": "affected",
        "version": "7.5 CE",
        "versionType": "custom"
      },
      {
        "lessThan": "5.0.12-hotfix update",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Cortex XDR Agent",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "7.8 all"
      },
      {
        "lessThan": "7.7*",
        "status": "unaffected",
        "version": "7.7.3",
        "versionType": "custom"
      },
      {
        "lessThan": "7.5 CE*",
        "status": "unaffected",
        "version": "7.5.101-CE",
        "versionType": "custom"
      },
      {
        "lessThan": "5.0*",
        "status": "unaffected",
        "version": "5.0.12-hotfix update",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0

Percentile

5.1%

Related for CVELIST:CVE-2022-0029