PT-2023-1381 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Agent

Robert Mccallum · Published 2023-02-08 · Updated 2024-01-12 · CVE-2023-0001

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Cortex XDR agent (affected versions not specified)

Description An information exposure issue in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext. This could be used by bad actors to execute privileged cytool commands, potentially disabling or uninstalling the agent. The vulnerability is related to the storage of data in an open manner, which can allow an attacker to gain unauthorized access to protected information and execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-319

CWE-312

Related Identifiers

BDU:2023-00739

CVE-2023-0001

Affected Products

Palo Alto Networks Cortex Xdr Agent

References · 8

• https://security.paloaltonetworks.com/CVE-2023-0001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0001 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00739 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-0001 · Security Note
• https://t.me/cvenotify/60985 · Telegram Post
• https://t.me/cvenotify/43916 · Telegram Post
• https://t.me/cibsecurity/57783 · Telegram Post
• https://t.me/cvenotify/67331 · Telegram Post