CVE-2021-3049: paloaltonetworks cortex xsoar

csirt@kutim:~/threat-intel/cve/CVE-2021-3049

CVSS 4.3 · Medium EPSS 0,49%

Kerentanan Improper Authorization pada paloaltonetworks cortex xsoar. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part of. This issue impacts: All Cortex XSOAR 5.5.0 builds; Cortex XSOAR 6.1.0 builds earlier than 12099345. This issue does not impact Cortex XSOAR 6.2.0 versions.

Rincian

Terbit di NVD: 8 September 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-285: Improper Authorization
EPSS (30 hari): 0,49% peluang dieksploitasi; lebih tinggi dari 40,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
paloaltonetworks	cortex xsoar	Versi 5.5.0
paloaltonetworks	cortex xsoar	Versi 5.5.0 70066
paloaltonetworks	cortex xsoar	Versi 5.5.0 73387
paloaltonetworks	cortex xsoar	Versi 5.5.0 75211
paloaltonetworks	cortex xsoar	Versi 5.5.0 78518
paloaltonetworks	cortex xsoar	Versi 5.5.0 94592
paloaltonetworks	cortex xsoar	Versi 6.1.0
paloaltonetworks	cortex xsoar	Versi 6.1.0 1016923
paloaltonetworks	cortex xsoar	Versi 6.1.0 1031903
paloaltonetworks	cortex xsoar	Versi 6.1.0 1077664
paloaltonetworks	cortex xsoar	Versi 6.1.0 848144

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://security.paloaltonetworks.com/CVE-2021-3049 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.