CVE-2024-5914 Cortex XSOAR: Command Injection in CommonScripts Pack

2024-08-1416:40:00

CWE-77

palo_alto

www.cve.org

cortex xsoar

command injection

palo alto networks

commonscripts pack

unauthenticated attacker

arbitrary commands

integration container

CVSS4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/SC:H/VI:L/SI:H/VA:L/SA:N/AU:N/U:Amber/R:U/V:D/RE:M

EPSS

0.001

Percentile

39.1%

JSON

A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Cortex XSOAR CommonScripts",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "changes": [
          {
            "at": "1.12.33",
            "status": "unaffected"
          }
        ],
        "lessThan": "1.12.33",
        "status": "affected",
        "version": "1.12",
        "versionType": "custom"
      }
    ]
  }
]