CVE-2022-0020 Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface
An authenticated attacker can inject persistent JavaScript into the Cortex XSOAR web interface, allowing arbitrary actions to be performed on behalf of administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-0020?
CVE-2022-0020 is a medium-severity cross-site scripting vulnerability in Palo Alto Networks Cortex XSOAR, published on 10 Feb 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations. This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.
Weakness: CWE-79
Which versions are affected by CVE-2022-0020?
It affects 1 product.
Products include Paloaltonetworks Cortex Xsoar.
How do I fix CVE-2022-0020?
No fix has been published for CVE-2022-0020 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-0020 being exploited?
There is no known exploitation of CVE-2022-0020 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Palo Alto Networks Cortex XSOAR
- CVE-2021-3044 Cortex XSOAR: Unauthorized Usage of the REST API
- CVE-2021-3051 Cortex XSOAR: Authentication Bypass in SAML Authentication
- CVE-2022-0031 Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
- CVE-2023-3282 Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine
- CVE-2021-3034 Cortex XSOAR: Secrets for SAML single sign-on (SSO) integration may be logged in system logs
Sources
Also known as GHSA-p58g-823f-vq5p.