PT-2021-3523 · Palo Alto Networks · Cortex Xsoar

Published 2021-06-22 · Updated 2022-07-14 · CVE-2021-3044

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cortex XSOAR versions 6.1.0 builds later than 1016923 through builds earlier than 1271064 Cortex XSOAR versions 6.2.0 builds earlier than 1271065

Description The issue is related to an improper authorization vulnerability in the REST API of Cortex XSOAR, allowing a remote unauthenticated attacker with network access to perform unauthorized actions. This vulnerability can be exploited to gain unauthorized access to protected information.

Recommendations For Cortex XSOAR versions 6.1.0 builds later than 1016923 through builds earlier than 1271064, upgrade to a version with build 1271064 or later to resolve the issue. For Cortex XSOAR versions 6.2.0 builds earlier than 1271065, upgrade to a version with build 1271065 or later to resolve the issue. As a temporary workaround, consider restricting access to the REST API until a patch is available.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BDU:2021-03573

CVE-2021-3044

Affected Products

Cortex Xsoar

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-3044 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3044 · Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2021-3044 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03573 · Security Note