CVE-2022-0027: paloaltonetworks cortex xsoar

csirt@kutim:~/threat-intel/cve/CVE-2022-0027

CVSS 4.3 · Medium EPSS 0,55%

Kerentanan Improper Authorization pada paloaltonetworks cortex xsoar. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email report that contains summary information about all incidents in the Cortex XSOAR instance, including incidents to which the user does not have access. This issue impacts: All versions of Cortex XSOAR 6.1; All versions of Cortex XSOAR 6.2; All versions of Cortex XSOAR 6.5; Cortex XSOAR 6.6 versions earlier than Cortex XSOAR 6.6.0 build 6.6.0.2585049.

Rincian

Terbit di NVD: 11 Mei 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-285: Improper Authorization
EPSS (30 hari): 0,55% peluang dieksploitasi; lebih tinggi dari 44,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
paloaltonetworks	cortex xsoar	Versi 6.6.0 hingga sebelum 6.6.0.2585049
paloaltonetworks	cortex xsoar	Versi 6.1.0
paloaltonetworks	cortex xsoar	Versi 6.2.0
paloaltonetworks	cortex xsoar	Versi 6.5.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://security.paloaltonetworks.com/CVE-2022-0027 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.