Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability

CVE-2022-0025
6.7MEDIUM

Key Information

Vendor
Palo Alto Networks
Status
Cortex Xdr Agent
Vendor
CVE Published:
11 May 2022

Badges

👾 Exploit Exists

Summary

A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts: All versions of the Cortex XDR agent when upgrading to Cortex XDR agent 7.7.0 on Windows; Cortex XDR agent 7.7.0 without content update 500 or a later version on Windows. This issue does not impact other platforms or other versions of the Cortex XDR agent.

Affected Version(s)

Cortex XDR Agent < 7.7.1.62043 without CU-500

Cortex XDR Agent >= 7.7.* with CU-500

Cortex XDR Agent >= 7.6 all

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit exists.

  • Initial publication

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Palo Alto Networks thanks its customers and external security researchers for discovering and reporting this issue.
.