PT-2021-18728 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Agent

Xavier Danest · Published 2021-07-15 · Updated 2021-07-27 · CVE-2021-3042

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Cortex XDR agent versions 6.1 through 7.3 without content update 181 or a later version

Description A local privilege escalation issue exists in the Palo Alto Networks Cortex XDR agent on Windows platforms, allowing an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have file creation privilege in the Windows root directory.

Recommendations For Cortex XDR agent versions 6.1 through 7.3, apply content update 181 or a later version to resolve the issue, as these updates are automatically applied for the agent.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2021-3042

Affected Products

Palo Alto Networks Cortex Xdr Agent

References · 4

• https://osv.dev/vulnerability/CVE-2021-3042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3042 · Security Note
• https://security.paloaltonetworks.com/CVE-2021-3042 · Vendor Advisory
• https://t.me/cibsecurity/26191 · Telegram Post