Vulnerability · Published Sep 8, 2021 · Assigned by palo_alto

CVE-2021-3049Cortex XSOAR: Improper Authorization of Incident Investigations Vulnerability

Low 2.6

In plain English

A low-severity security flaw in Cortex XSOAR from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)2.6Low

Exploit odds (30 days)0.5%top 57.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex XSOAR 5.5.0 builds; Cortex XSOAR 6.1.0 builds earlier than 12099345. This issue does not impact Cortex XSOAR 6.2.0 versions.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	Cortex XSOAR	5.5.0 all6.1.0 – before 12099345

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

References

https://security.paloaltonetworks.com/CVE-2021-3049 x_refsource_MISC