title: Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server
description: A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.
problem types: CWE-73 External Control of File Name or Path
affected:
{
defaultStatus: unaffected
modules: Cortex XSOAR Server
product: Cortex XSOAR
vendor: Palo Alto Networks
versions:
status: unaffected, version: 8.1 All
changes: [at: 6.10.0.185964, status: unaffected], lessThan: 6.10.0.185964, status: affected, version: 6.10.0.0, versionType: custom
changes: [at: 6.9.B185415, status: unaffected], lessThan: 6.9.B185415, status: affected, version: 6.9, versionType: custom
changes: [at: 6.8.B185719, status: unaffected], lessThan: 6.8.B185719, status: affected, version: 6.8, versionType: custom
changes: [at: 6.6.B186115, status: unaffected], lessThan: 6.6.B186115, status: affected, version: 6.6, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: This issue is fixed in Cortex XSOAR 6.6 build B186115, Cortex XSOAR 6.8 build B185719, Cortex XSOAR 6.9 build B185415, Cortex XSOAR 6.10 build 185964, and all later builds of Cortex XSOAR.
NOTE: Cortex XSOAR 6.10.0 build 185964 is generally available for customers to download. Customers using Cortex XSOAR hosted services, and those wanting to upgrade to a non-generally available build, will need to make a Customer Support request at  https://support.paloaltonetworks.com/ https://support.paloaltonetworks.com/  to upgrade.
workarounds: There are no known workarounds for this issue.