Lucene search

Palo_altoVULNRICHMENT:CVE-2024-5907

HistoryJun 12, 2024 - 4:26 p.m.

CVE-2024-5907 Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability

2024-06-1216:26:39

CWE-269

palo_alto

github.com

palo alto networks

vulnerability

windows

privilege escalation

cortex xdr

local user

race condition

5.2 Medium

CVSS4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/SC:H/VI:L/SI:H/VA:N/SA:H/AU:N/U:Amber/R:U/V:D/RE:M

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully exploit a race condition, which makes this vulnerability difficult to exploit.

CNA Affected

[
  {
    "vendor": "Palo Alto Networks",
    "product": "Cortex XDR Agent",
    "versions": [
      {
        "status": "affected",
        "changes": [
          {
            "at": "7.9.102-CE",
            "status": "unaffected"
          }
        ],
        "version": "7.9-CE",
        "lessThan": "7.9.102-CE",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "8.1.0"
      },
      {
        "status": "affected",
        "changes": [
          {
            "at": "8.2.3",
            "status": "unaffected"
          }
        ],
        "version": "8.2.0",
        "lessThan": "8.2.3",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "changes": [
          {
            "at": "8.3.1",
            "status": "unaffected"
          }
        ],
        "version": "8.3.0",
        "lessThan": "8.3.1",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "8.4.0"
      }
    ],
    "platforms": [
      "Windows"
    ],
    "defaultStatus": "unaffected"
  }
]

References

security.paloaltonetworks.com/CVE-2024-5907