QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-3049

Back to search

CVE-2021-3049

Published: Sep 8, 2021

Modified: Sep 16, 2024

PUBLISHED

CVSS v3.1

2.6

LOW

Description

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex XSOAR 5.5.0 builds; Cortex XSOAR 6.1.0 builds earlier than 12099345. This issue does not impact Cortex XSOAR 6.2.0 versions.

VendorProductVersions

Palo Alto Networks

Cortex XSOAR

affected
5.5.0 all
unaffected
6.2.0 all
affected
6.1.0 - < 12099345

Weaknesses (CWE)

CWE-285

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now