CVE-2021-3049 Cortex XSOAR: Improper Authorization of Incident Investigations Vulnerability

What is CVE-2021-3049?

CVE-2021-3049 is a low-severity missing authorization vulnerability in Palo Alto Networks Cortex XSOAR, published on 8 Sep 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex XSOAR 5.5.0 builds; Cortex XSOAR 6.1.0 builds earlier than 12099345. This issue does not impact Cortex XSOAR 6.2.0 versions.

Weakness: CWE-285

Which versions are affected by CVE-2021-3049?

It affects 1 product.

Products include Paloaltonetworks Cortex Xsoar.

How do I fix CVE-2021-3049?

No fix has been published for CVE-2021-3049 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-3049 being exploited?

There is no known exploitation of CVE-2021-3049 in the wild and no public exploit code.

Other vulnerabilities in Palo Alto Networks Cortex XSOAR

• CVE-2021-3044 Cortex XSOAR: Unauthorized Usage of the REST API Critical 9.8
• CVE-2021-3051 Cortex XSOAR: Authentication Bypass in SAML Authentication High 8.1
• CVE-2022-0020 Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface Medium 6.8
• CVE-2022-0031 Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine Medium 6.7
• CVE-2023-3282 Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j74x-6rh4-f7q2.