CVE-2022-0013CWE-538

Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support File

Medium · published January 12, 2022

CVSS v3.1
5.0
EPSS
0%
Percentile
11.8
In the wild
Unconfirmed
What it is

A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary files on the system with elevated privileges when generating a support file. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.4; Cortex XDR agent 7.3 versions earlier than Cortex XDR agent 7.3.2.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.8th percentile
Weakness
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2022-01-12T17:30Z
EPSS history
Timeline
  • 12 JAN 17:30Z
    Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support File
    cvelistv5