Lucene search

Palo Alto Networks Product Security Incident Response TeamPA-CVE-2022-0015

HistoryJan 12, 2022 - 5:00 p.m.

Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability

2022-01-1217:00:00

Palo Alto Networks Product Security Incident Response Team

securityadvisories.paloaltonetworks.com

cortex xdr

vulnerability

local privilege escalation

palo alto networks

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges.

Work around:
There are no known workarounds for this issue.

Affected configurations

Vulners

Node

softwarecortex_xdr_agentRange<5.0.12

softwarecortex_xdr_agentRange<6.1.9

VendorProductVersionCPE
softwarecortex_xdr_agent*cpe:2.3:a:software:cortex_xdr_agent:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
software	cortex_xdr_agent	*	cpe:2.3:a:software:cortex_xdr_agent::::::::

References

security.paloaltonetworks.com/CVE-2022-0015

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for PA-CVE-2022-0015