CVE-2022-0020

paloaltonetworks cortex xsoar

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-0020

Katalog CVE

CVSS 5.4 · Medium EPSS 1,7%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada paloaltonetworks cortex xsoar. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations. This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.

Rincian

Terbit di NVD
10 Februari 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
1,7% peluang dieksploitasi; lebih tinggi dari 76,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
paloaltonetworks cortex xsoar Versi 6.1.0
paloaltonetworks cortex xsoar Versi 6.1.0 1016923
paloaltonetworks cortex xsoar Versi 6.1.0 1031903
paloaltonetworks cortex xsoar Versi 6.1.0 1077664
paloaltonetworks cortex xsoar Versi 6.1.0 1209934
paloaltonetworks cortex xsoar Versi 6.1.0 1271079
paloaltonetworks cortex xsoar Versi 6.1.0 848144
paloaltonetworks cortex xsoar Versi 6.2.0
paloaltonetworks cortex xsoar Versi 6.2.0 1271082
paloaltonetworks cortex xsoar Versi 6.2.0 1321594
paloaltonetworks cortex xsoar Versi 6.2.0 1473927
paloaltonetworks cortex xsoar Versi 6.2.0 1578666
paloaltonetworks cortex xsoar Versi 6.2.0 1822745

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.