Cortex XSOAR: Unauthorized Usage of the REST API

An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 builds later than 1016923 and earlier than 1271064; Cortex XSOAR 6.2.0 builds earlier than 1271065. This issue does not impact Cortex XSOAR 5.5.0, Cortex XSOAR 6.0.0, Cortex XSOAR 6.0.1, or Cortex XSOAR 6.0.2 versions. All Cortex XSOAR instances hosted by Palo Alto Networks are upgraded to resolve this vulnerability. No additional action is required for these instances.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

授权机制不恰当

Palo Alto Networks Cortex XSOAR 安全漏洞

Palo Alto Networks Cortex XSOAR是美国 （Palo Alto Networks）公司的一个应用软件。提供安全编排，自动化和响应平台，带有威胁情报管理和内置市场。 Palo Alto Networks Cortex XSOAR 存在安全漏洞，该漏洞允许远程未经身份验证的攻击者利用该漏洞能够通过REST API执行未经授权的操作。以下产品及版本受到影响:Cortex XSOAR 6.1.0 builds（1016923之后以及1271064之前的版本），Cortex XSOAR

N/A

N/A