Skip to content
CVE PROGRAM SOURCE RECORD2.6 Low

CVE-2021-3049

Cortex XSOAR: Improper Authorization of Incident Investigations Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex XSOAR 5.5.0 builds; Cortex XSOAR 6.1.0 builds earlier than 12099345. This issue does not impact Cortex XSOAR 6.2.0 versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks Cortex XSOAR

  • 5.5.0 allaffected
  • 6.2.0 allunaffected
  • 6.1.0 to < 12099345affected

References