Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server (Palo Alto Networks Cortex XSOAR)
En bref
- Source
- NVD
- EPSS
- EPSS 1.33 % · centile 71 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- palo_alto
- Statut NVD
- Modified
Description
A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.
Faiblesses (CWE)
- CWE-73 — External Control of File Name or Path
- CWE-610 — Référence contrôlée de l'extérieur vers une ressource d'une autre sphère
Références
- https://security.paloaltonetworks.com/CVE-2023-0003
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | palo_alto |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-12108
- GCVE · GCVE-0-2023-0003
Avis du CERT-FR
- CERTFR-2023-AVI-0105 — Multiples vulnérabilités dans les produits PaloAlto · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:paloaltonetworks:cortex_xsoar:*:*:*:*:*:*:*:*≥ 6.10.0 < 6.10.0.185964cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.6.0:2585049:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.6.0:2889656:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.6.0:3049220:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.6.0:3124193:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.8.0:176620:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.8.0:3261002:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.9.0:130766:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.9.0:177754:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Palo Alto Networks · Cortex XSOAR | unaffected 8.1 All ; affected 6.10.0.0 < 6.10.0.185964 ; affected 6.9 < 6.9.B185415 ; affected 6.8 < 6.8.B185719 ; affected 6.6 < 6.6.B186115 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |