CVE-2022-0020Medium

CVE-2022-0020 Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface

Published
February 9, 2022
Last Modified
February 9, 2022

🔗 CVE IDs covered (1)

CVE-2022-0020 →

📋 Description

A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations.

This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.

🎯 Affected products1

  • Cortex XSOAR

✅ Remediation

This issue is fixed in Cortex XSOAR 6.2.0 build 1958888 and all later Cortex XSOAR versions. Workarounds and mitigations: There are no known workarounds for this issue.

🔗 References (1)