Vulnerability-Lookup

CERTFR-2020-AVI-815

Vulnerability from certfr_avis - Published: 2020-12-10 - Updated: 2020-12-10

De multiples vulnérabilités ont été découvertes dans Palo Alto Cortex XDR. Elles permettent à un attaquant de provoquer un déni de service et une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	Windows	agent Cortex XDR 6.1.x versions antérieures à 6.1.7 et sans le dernier content update pour Windows
Microsoft	Windows	agent Cortex XDR 7.2.x sans le content update 150 pour Windows
Microsoft	Windows	agent Cortex XDR 7.1.x versions antérieures à 7.1.2 et sans le content update 150 pour Windows
Microsoft	N/A	agent Cortex XDR 5.0.x versions antérieures à 5.0.10
Microsoft	Windows	agent Cortex XDR 7.0.x versions antérieures à 7.0.3 et sans le dernier content update pour Windows

References

Title

Publication Time

Tags

Bulletin de sécurité Palo Alto CVE-2020-2020 du 09 décembre 2020	None	vendor-advisory
Bulletin de sécurité Palo Alto CVE-2020-2049 du 09 décembre 2020	None	vendor-advisory

Show details on source website

JSON

To clipboard Create KEV Entry

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "agent Cortex XDR 6.1.x versions ant\u00e9rieures \u00e0 6.1.7 et sans le dernier content update pour Windows",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "agent Cortex XDR 7.2.x sans le content update 150 pour Windows",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "agent Cortex XDR 7.1.x versions ant\u00e9rieures \u00e0 7.1.2 et sans le content update 150 pour Windows",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "agent Cortex XDR 5.0.x versions ant\u00e9rieures \u00e0 5.0.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "agent Cortex XDR 7.0.x versions ant\u00e9rieures \u00e0 7.0.3 et sans le dernier content update pour Windows",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-2049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2049"
    },
    {
      "name": "CVE-2020-2020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-2020"
    }
  ],
  "initial_release_date": "2020-12-10T00:00:00",
  "last_revision_date": "2020-12-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-815",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-12-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Palo Alto Cortex\nXDR. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service et\nune \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Palo Alto Cortex XDR",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto CVE-2020-2020 du 09 d\u00e9cembre 2020",
      "url": "https://security.paloaltonetworks.com/CVE-2020-2020"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto CVE-2020-2049 du 09 d\u00e9cembre 2020",
      "url": "https://security.paloaltonetworks.com/CVE-2020-2049"
    }
  ]
}

CVE-2020-2049 (GCVE-0-2020-2049)

Vulnerability from cvelistv5 – Published: 2020-12-09 18:00 – Updated: 2024-09-17 02:53

Title

Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation

Summary

A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

palo_alto

References

URL

Tags

https://security.paloaltonetworks.com/CVE-2020-2049

x_refsource_MISC

Impacted products

Vendor

Product

Version

Palo Alto Networks

Cortex XDR Agent

Unaffected: 7.1.* with content update 150
Affected: 7.1.* without content update 150
Unaffected: 7.2.* with content update 150
Affected: 7.2.* without content update 150

Palo Alto Networks

Cortex XDR Agent

Unaffected: 6.1.* with latest content
Unaffected: 7.0.* with latest content

Credits

Palo Alto Networks thanks Chris Au of PwC Hong Kong - Darklab and Xavier DANEST of Decathlon for discovering and reporting this issue.

Show details on NVD website

JSON

To clipboard Create KEV Entry

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:54:00.705Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2020-2049"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Cortex XDR Agent",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.1.* with content update 150"
            },
            {
              "status": "affected",
              "version": "7.1.* without content update 150"
            },
            {
              "status": "unaffected",
              "version": "7.2.* with content update 150"
            },
            {
              "status": "affected",
              "version": "7.2.* without content update 150"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Cortex XDR Agent",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "6.1.* with latest content"
            },
            {
              "status": "unaffected",
              "version": "7.0.* with latest content"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Palo Alto Networks thanks Chris Au of PwC Hong Kong - Darklab and Xavier DANEST of Decathlon for discovering and reporting this issue."
        }
      ],
      "datePublic": "2020-12-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-09T18:00:14",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2020-2049"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Cortex XDR Agent content update version 150 and all later content update versions resolve this issue for Cortex XDR Agent 7.1 and Cortex XDR Agent 7.2 versions.\n\nCortex XDR Agent 6.1 and Cortex XDR Agent 7.0 are not impacted with the latest content update.\n\nContent updates are automatically applied for the agent. A Cortex XDR Agent version upgrade is not required to resolve this issue."
        }
      ],
      "source": {
        "defect": [
          "CPATR-11314",
          "CPATR-10346"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2020-12-09T00:00:00",
          "value": "Initial publication"
        }
      ],
      "title": "Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation",
      "workarounds": [
        {
          "lang": "en",
          "value": "This issue is mitigated by preventing local authenticated Windows users from creating files in the Windows root directory such as C:\\."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2020-12-09T17:00:00.000Z",
          "ID": "CVE-2020-2049",
          "STATE": "PUBLIC",
          "TITLE": "Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cortex XDR Agent",
                      "version": {
                        "version_data": [
                          {
                            "platform": "Windows",
                            "version_affected": "!",
                            "version_name": "7.1",
                            "version_value": "7.1.* with content update 150"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "=",
                            "version_name": "7.1",
                            "version_value": "7.1.* without content update 150"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "!",
                            "version_name": "7.2",
                            "version_value": "7.2.* with content update 150"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "=",
                            "version_name": "7.2",
                            "version_value": "7.2.* without content update 150"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "!",
                            "version_name": "6.1",
                            "version_value": "6.1.* with latest content"
                          },
                          {
                            "platform": "Windows",
                            "version_affected": "!",
                            "version_name": "7.0",
                            "version_value": "7.0.* with latest content"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Palo Alto Networks thanks Chris Au of PwC Hong Kong - Darklab and Xavier DANEST of Decathlon for discovering and reporting this issue."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-427 Uncontrolled Search Path Element"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2020-2049",
              "refsource": "MISC",
              "url": "https://security.paloaltonetworks.com/CVE-2020-2049"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Cortex XDR Agent content update version 150 and all later content update versions resolve this issue for Cortex XDR Agent 7.1 and Cortex XDR Agent 7.2 versions.\n\nCortex XDR Agent 6.1 and Cortex XDR Agent 7.0 are not impacted with the latest content update.\n\nContent updates are automatically applied for the agent. A Cortex XDR Agent version upgrade is not required to resolve this issue."
          }
        ],
        "source": {
          "defect": [
            "CPATR-11314",
            "CPATR-10346"
          ],
          "discovery": "EXTERNAL"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2020-12-09T00:00:00",
            "value": "Initial publication"
          }
        ],
        "work_around": [
          {
            "lang": "en",
            "value": "This issue is mitigated by preventing local authenticated Windows users from creating files in the Windows root directory such as C:\\."
          }
        ],
        "x_affectedList": [
          "Cortex XDR Agent 7.2",
          "Cortex XDR Agent 7.1"
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2020-2049",
    "datePublished": "2020-12-09T18:00:14.602237Z",
    "dateReserved": "2019-12-04T00:00:00",
    "dateUpdated": "2024-09-17T02:53:03.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2020 (GCVE-0-2020-2020)

Vulnerability from cvelistv5 – Published: 2020-12-09 18:00 – Updated: 2024-09-16 20:17

Title

Cortex XDR Agent: Exceptional condition denial-of-service (DoS)

Summary

An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition is persistent and prevents Cortex XDR Agent from starting when the software or machine is restarted. This issue impacts: Cortex XDR Agent 5.0 versions earlier than 5.0.10; Cortex XDR Agent 6.1 versions earlier than 6.1.7; Cortex XDR Agent 7.0 versions earlier than 7.0.3; Cortex XDR Agent 7.1 versions earlier than 7.1.2.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-755 - Improper Handling of Exceptional Conditions

Assigner

palo_alto

References

URL

Tags

https://security.paloaltonetworks.com/CVE-2020-2020

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Palo Alto Networks	Cortex XDR Agent	Affected: 7.0 , < 7.0.3 (custom) Affected: 7.1 , < 7.1.2 (custom) Affected: 5.0 , < 5.0.10 (custom) Affected: 6.1 , < 6.1.7 (custom) Unaffected: 7.2.0 , < 7.2* (custom)

Credits

Palo Alto Networks thanks Paul van der Haas of Orange Cyberdefense for discovering and reporting this issue.

Show details on NVD website

JSON

To clipboard Create KEV Entry

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:54:00.594Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2020-2020"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cortex XDR Agent",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "7.0.3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "7.0.3",
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "7.1.2",
                  "status": "unaffected"
                }
              ],
              "lessThan": "7.1.2",
              "status": "affected",
              "version": "7.1",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "5.0.10",
                  "status": "unaffected"
                }
              ],
              "lessThan": "5.0.10",
              "status": "affected",
              "version": "5.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "6.1.7",
                  "status": "unaffected"
                }
              ],
              "lessThan": "6.1.7",
              "status": "affected",
              "version": "6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "7.2*",
              "status": "unaffected",
              "version": "7.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Palo Alto Networks thanks Paul van der Haas of Orange Cyberdefense for discovering and reporting this issue."
        }
      ],
      "datePublic": "2020-12-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software\u0027s internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition is persistent and prevents Cortex XDR Agent from starting when the software or machine is restarted. This issue impacts: Cortex XDR Agent 5.0 versions earlier than 5.0.10; Cortex XDR Agent 6.1 versions earlier than 6.1.7; Cortex XDR Agent 7.0 versions earlier than 7.0.3; Cortex XDR Agent 7.1 versions earlier than 7.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755 Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-09T18:00:13",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2020-2020"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue is fixed in Cortex XDR Agent 5.0.10, Cortex XDR Agent 6.1.7, Cortex XDR Agent 7.0.3, Cortex XDR Agent 7.1.2, and all later Cortex XDR Agent versions."
        }
      ],
      "source": {
        "defect": [
          "CPATR-9871"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2020-12-09T00:00:00",
          "value": "Initial publication"
        }
      ],
      "title": "Cortex XDR Agent: Exceptional condition denial-of-service (DoS)",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2020-12-09T17:00:00.000Z",
          "ID": "CVE-2020-2020",
          "STATE": "PUBLIC",
          "TITLE": "Cortex XDR Agent: Exceptional condition denial-of-service (DoS)"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cortex XDR Agent",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "7.0",
                            "version_value": "7.0.3"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "7.1",
                            "version_value": "7.1.2"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "5.0",
                            "version_value": "5.0.10"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "6.1",
                            "version_value": "6.1.7"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "7.0",
                            "version_value": "7.0.3"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "7.1",
                            "version_value": "7.1.2"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "5.0",
                            "version_value": "5.0.10"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "6.1",
                            "version_value": "6.1.7"
                          },
                          {
                            "version_affected": "!\u003e=",
                            "version_name": "7.2",
                            "version_value": "7.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Palo Alto Networks thanks Paul van der Haas of Orange Cyberdefense for discovering and reporting this issue."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software\u0027s internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition is persistent and prevents Cortex XDR Agent from starting when the software or machine is restarted. This issue impacts: Cortex XDR Agent 5.0 versions earlier than 5.0.10; Cortex XDR Agent 6.1 versions earlier than 6.1.7; Cortex XDR Agent 7.0 versions earlier than 7.0.3; Cortex XDR Agent 7.1 versions earlier than 7.1.2."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-755 Improper Handling of Exceptional Conditions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2020-2020",
              "refsource": "MISC",
              "url": "https://security.paloaltonetworks.com/CVE-2020-2020"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "This issue is fixed in Cortex XDR Agent 5.0.10, Cortex XDR Agent 6.1.7, Cortex XDR Agent 7.0.3, Cortex XDR Agent 7.1.2, and all later Cortex XDR Agent versions."
          }
        ],
        "source": {
          "defect": [
            "CPATR-9871"
          ],
          "discovery": "EXTERNAL"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2020-12-09T00:00:00",
            "value": "Initial publication"
          }
        ],
        "x_affectedList": [
          "Cortex XDR Agent 7.1",
          "Cortex XDR Agent 7.0",
          "Cortex XDR Agent 6.1",
          "Cortex XDR Agent 5.0"
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2020-2020",
    "datePublished": "2020-12-09T18:00:14.069887Z",
    "dateReserved": "2019-12-04T00:00:00",
    "dateUpdated": "2024-09-16T20:17:18.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2020-AVI-815

Solution

CVE-2020-2049 (GCVE-0-2020-2049)

CVE-2020-2020 (GCVE-0-2020-2020)

Tags

Sightings

Nomenclature