title: Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability
description: A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.12; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.9.
problem types: CWE-427 Uncontrolled Search Path Element
affected:
{
product: Cortex XDR Agent
vendor: Palo Alto Networks
versions:
status: unaffected, version: 7.2.*
status: unaffected, version: 7.3.*
status: unaffected, version: 7.4.*
status: unaffected, version: 7.5.*
status: unaffected, version: 7.6.*
changes: [at: 5.0.12, status: unaffected], lessThan: 5.0.12, status: affected, version: 5.0, versionType: custom
changes: [at: 6.1.9, status: unaffected], lessThan: 6.1.9, status: affected, version: 6.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
exploits: Palo Alto Networks is not aware of any malicious exploitation of this issue.
solutions: This issue is fixed in Cortex XDR agent 5.0.12, Cortex XDR agent 6.1.9, and all later Cortex XDR agent versions.
workarounds: There are no known workarounds for this issue.