PT-2023-1384 · Palo Alto Networks · Palo Alto Networks Cortex Xsoar

Eric Turpin · Published 2023-02-08 · Updated 2024-02-16 · CVE-2023-0003

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Cortex XSOAR (affected versions not specified)

Description A file disclosure issue in the Palo Alto Networks Cortex XSOAR server software allows an authenticated user with access to the web interface to read local files from the server. This is related to incorrect external control of a file name or path. Exploitation of this issue may enable a remote attacker to read arbitrary files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-610

CWE-73

Related Identifiers

BDU:2023-00751

CVE-2023-0003

Affected Products

Palo Alto Networks Cortex Xsoar

References · 19

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0003 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y · Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2023-0003 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00751 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0003 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE · Vendor Advisory
• https://t.me/cvenotify/71757 · Telegram Post