An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email report that contains summary information about all incidents in the Cortex XSOAR instance, including incidents to which the user does not have access. This issue impacts: All versions of Cortex XSOAR 6.1; All versions of Cortex XSOAR 6.2; All versions of Cortex XSOAR 6.5; Cortex XSOAR 6.6 versions earlier than Cortex XSOAR 6.6.0 build 6.6.0.2585049.
References
| Link | Resource |
|---|---|
| https://security.paloaltonetworks.com/CVE-2022-0027 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
26 Jun 2023, 17:59
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
20 May 2022, 13:30
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://security.paloaltonetworks.com/CVE-2022-0027 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| CWE | CWE-863 | |
| CPE | cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.5.0:-:*:*:*:*:*:* cpe:2.3:a:paloaltonetworks:cortex_xsoar:*:*:*:*:*:*:*:* cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.1.0:-:*:*:*:*:*:* cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.2.0:-:*:*:*:*:*:* |
|
| First Time |
Paloaltonetworks
Paloaltonetworks cortex Xsoar |
11 May 2022, 17:20
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-05-11 17:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-0027
Mitre link : CVE-2022-0027
CVE.ORG link : CVE-2022-0027
JSON object : View
Products Affected
paloaltonetworks
- cortex_xsoar
CWE