Lucene search

Palo_altoVULNRICHMENT:CVE-2024-5912

HistoryJul 10, 2024 - 6:40 p.m.

CVE-2024-5912 Cortex XDR Agent: Improper File Signature Verification Checks

2024-07-1018:40:16

CWE-347

palo_alto

github.com

cortex xdr

file signature

verification checks

palo alto networks

executable blocking

untrusted executables

device security

CVSS4

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:H/SI:N/VA:N/SA:N/AU:N/U:Amber/R:U/V:C/RE:M

AI Score

7.2

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent’s executable blocking capabilities and run untrusted executables on the device. This issue can be leveraged to execute untrusted software without being detected or blocked.

CNA Affected

[
  {
    "vendor": "Palo Alto Networks",
    "product": "Cortex XDR Agent",
    "versions": [
      {
        "status": "unaffected",
        "version": "8.4",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "8.3-CE",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "8.3",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "changes": [
          {
            "at": "7.9.102-CE",
            "status": "unaffected"
          }
        ],
        "version": "7.9-CE",
        "lessThan": "7.9.102-CE",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "changes": [
          {
            "at": "8.2.2",
            "status": "unaffected"
          }
        ],
        "version": "8.2",
        "lessThan": "8.2.2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

security.paloaltonetworks.com/CVE-2024-5912