What is CVE-2023-0001?

CVE-2023-0001 is a security advisory published by Palo Alto Networks Security Advisories with Medium severity. CVE-2023-0001 Cortex XDR Agent: Cleartext Exposure of Agent Admin Password

Which CVE IDs does CVE-2023-0001 cover?

CVE-2023-0001 covers the following CVE IDs: CVE-2023-0001. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2023-0001?

CVE-2023-0001 affects 1 product, including: Cortex XDR Agent.

CVE-2023-0001Medium

CVE-2023-0001 Cortex XDR Agent: Cleartext Exposure of Agent Admin Password

Vendor

Palo Alto Networks Security Advisories

Published

February 8, 2023

Last Modified

February 8, 2023

🔗 CVE IDs covered (1)

CVE-2023-0001 →

📋 Description

An information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local system administrator to disclose the admin password for the agent in cleartext, which bad actors can then use to execute privileged cytool commands that disable or uninstall the agent.

🎯 Affected products1

Cortex XDR Agent

✅ Remediation

This issue is fixed in Cortex XDR agent 7.5.101-CE and all later supported Cortex XDR agent versions. (Cortex XDR agent 5.0 is not impacted.) After you upgrade to a fixed version of the Cortex XDR agent, you must change the agent admin password in case it was already disclosed to users. Workarounds and mitigations: There are no known workarounds for this issue.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/CVE-2023-0001