FKIE_CVE-2022-0026

Vulnerability from fkie_nvd - Published: 2022-05-11 17:15 - Updated: 2024-11-21 06:37
Severity ?
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.7 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version.
References
psirt@paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2022-0026Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.paloaltonetworks.com/CVE-2022-0026Vendor Advisory
Impacted products
Vendor Product Version
paloaltonetworks cortex_xdr_agent 6.1
paloaltonetworks cortex_xdr_agent 6.1
paloaltonetworks cortex_xdr_agent 6.1.4
paloaltonetworks cortex_xdr_agent 6.1.4
paloaltonetworks cortex_xdr_agent 6.1.5
paloaltonetworks cortex_xdr_agent 6.1.5
paloaltonetworks cortex_xdr_agent 6.1.5
paloaltonetworks cortex_xdr_agent 6.1.6
paloaltonetworks cortex_xdr_agent 6.1.6
paloaltonetworks cortex_xdr_agent 6.1.7
paloaltonetworks cortex_xdr_agent 6.1.7
paloaltonetworks cortex_xdr_agent 6.1.8
paloaltonetworks cortex_xdr_agent 6.1.8
paloaltonetworks cortex_xdr_agent 6.1.9
paloaltonetworks cortex_xdr_agent 6.1.9
paloaltonetworks cortex_xdr_agent 7.4.1
paloaltonetworks cortex_xdr_agent 7.4.1
paloaltonetworks cortex_xdr_agent 7.4.2
paloaltonetworks cortex_xdr_agent 7.4.2
paloaltonetworks cortex_xdr_agent 7.4.3
paloaltonetworks cortex_xdr_agent 7.4.3
paloaltonetworks cortex_xdr_agent 7.4.4
paloaltonetworks cortex_xdr_agent 7.4.4
paloaltonetworks cortex_xdr_agent 7.5
paloaltonetworks cortex_xdr_agent 7.5.1
paloaltonetworks cortex_xdr_agent 7.5.1
paloaltonetworks cortex_xdr_agent 7.5.2
paloaltonetworks cortex_xdr_agent 7.5.2
paloaltonetworks cortex_xdr_agent 7.5.3
paloaltonetworks cortex_xdr_agent 7.5.3
paloaltonetworks cortex_xdr_agent 7.6.1
paloaltonetworks cortex_xdr_agent 7.6.1
paloaltonetworks cortex_xdr_agent 7.6.2
paloaltonetworks cortex_xdr_agent 7.6.2
paloaltonetworks cortex_xdr_agent 7.7
paloaltonetworks cortex_xdr_agent 7.7
paloaltonetworks cortex_xdr_agent 7.7.1
paloaltonetworks cortex_xdr_agent 7.7.1
microsoft windows -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "8535E8E2-188C-460B-86A8-F463854F5DFE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "09A12884-47E6-451E-9751-F871F12692E7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.4:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "6F522F4D-8740-41C2-A662-2D3FADB98ADB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.4:hotfix:*:*:*:*:*:*",
              "matchCriteriaId": "559A6865-F8E3-4F6B-A53B-5EA48C5B9120",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.5:-:*:*:*:*:*:*",
              "matchCriteriaId": "0B027DB3-7A70-443B-B5F4-B66A3BCCF2A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.5:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "7103C435-D4CC-46BE-8487-03ADF0135792",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.5:hotfix:*:*:*:*:*:*",
              "matchCriteriaId": "14B92689-A030-44F3-9B66-2E003198A407",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.6:-:*:*:*:*:*:*",
              "matchCriteriaId": "920FAB2B-4AEC-48FD-9744-617BC6C494CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.6:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "4F81B9E1-E1A1-4910-AE0C-65BC8F554A47",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.7:-:*:*:*:*:*:*",
              "matchCriteriaId": "2BECB228-650F-448A-931D-DFA7D097E41E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.7:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "1FC042EE-8F41-466C-9D85-556092102EE7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.8:-:*:*:*:*:*:*",
              "matchCriteriaId": "30B091F7-AE11-4540-A945-7100ACE812AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.8:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "5F880FD5-FCC6-4FEE-AB48-088C9C431E64",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.9:-:*:*:*:*:*:*",
              "matchCriteriaId": "6792CE52-83C7-4601-B9E5-54FF77103DB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:6.1.9:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "600E93EA-21E5-41F1-977A-43F0513C2468",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "5257930C-27F0-4A1E-B5C9-D3D76C27715D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.1:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "0C01C824-2578-4C11-9578-731B597BECB1",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "CA4B14D7-5E03-4635-9D75-CEEF0D913EFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.2:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "737275AC-C43D-4636-AE0E-BB24A192C525",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "799B0C1C-8963-4A04-A3A2-E1D97C6BE467",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.3:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "D1221A81-E602-4629-93B8-3ABCA7C1F6C0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "210954DD-8719-4212-8725-3201EF7AF9D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.4.4:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "603A11D1-B95D-48E2-B61C-012B3675D4B7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5:-:*:*:content_engine:*:*:*",
              "matchCriteriaId": "B6E273B6-A3A4-47EF-9E37-B123B61ECE23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "716232DD-F8C1-43A3-870A-A6C19D7A4416",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.1:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "8E023342-504F-4DF4-8D2F-F824DE72757D",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "D63504E2-E27A-4714-AB1C-CC67675E47E0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.2:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "5399BD2D-B6F0-4368-BBAA-D25C3A5B7BAA",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.3:-:*:*:*:*:*:*",
              "matchCriteriaId": "D8D5A99A-BB66-4C4D-BFAB-5B07B0A98BAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.5.3:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "42502AD9-5F5E-441C-B32D-FAEDA4D2BBF9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.6.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "B5D4BBBE-57DE-438A-97B3-29C59EA8C48D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.6.1:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "13CBA514-D865-4C9F-A2FE-D2FA3B289DC5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.6.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "1E4BCC91-31AB-4318-8A1F-D043392F09E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.6.2:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "3E421078-40E0-4D3D-A6A3-825EF9452E99",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.7:-:*:*:*:*:*:*",
              "matchCriteriaId": "EEDE5C5B-48F9-4211-9F98-085C3C5E19FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.7:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "A9D89CF1-E2F8-4498-859F-D6FB4F9DC82B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.7.1:-:*:*:*:*:*:*",
              "matchCriteriaId": "C2927A74-24A5-459B-9D61-2718643F3338",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:7.7.1:content_update330:*:*:*:*:*:*",
              "matchCriteriaId": "483211AE-3205-4DCD-B602-EE707684C464",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de escalada de privilegios (PE) local en el software Cortex XDR agent de Palo Alto Networks en Windows que permite a un usuario local autenticado con privilegios de creaci\u00f3n de archivos en el directorio root de Windows (como C:\\) ejecutar un programa con altos privilegios. Este problema afecta a todas las versiones de Cortex XDR agent sin la actualizaci\u00f3n de contenido 330 o una versi\u00f3n posterior de actualizaci\u00f3n de contenido"
    }
  ],
  "id": "CVE-2022-0026",
  "lastModified": "2024-11-21T06:37:50.823",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "psirt@paloaltonetworks.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-05-11T17:15:09.287",
  "references": [
    {
      "source": "psirt@paloaltonetworks.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.paloaltonetworks.com/CVE-2022-0026"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.paloaltonetworks.com/CVE-2022-0026"
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-282"
        }
      ],
      "source": "psirt@paloaltonetworks.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.