2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Cortex XDR Broker VM","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"30.0.49","status":"unaffected"}],"lessThan":"30.0.49","status":"affected","version":"30.0.0","versionType":"custom"}]}],"source":"psirt@paloaltonetworks.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An information disclosure vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to obtain and modify sensitive information by triggering live terminal session via Cortex UI and modifying any configuration setting. \nThe attacker must have network access to the Broker VM to exploit this issue."},{"lang":"es","value":"Una vulnerabilidad de revelación de información en Palo Alto Networks Cortex XDR® Broker VM permite a un usuario autenticado obtener y modificar información sensible al activar una sesión de terminal en vivo a través de la interfaz de usuario de Cortex y modificar cualquier ajuste de configuración.\nEl atacante debe tener acceso de red al Broker VM para explotar este problema."}],"id":"CVE-2026-0231","lastModified":"2026-06-17T10:10:34.487","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"psirt@paloaltonetworks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0231","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-11T20:21:23.660381Z","version":"2.0.3"}}]},"published":"2026-03-11T18:16:21.413","references":[{"source":"psirt@paloaltonetworks.com","url":"https://security.paloaltonetworks.com/CVE-2026-0231"}],"sourceIdentifier":"psirt@paloaltonetworks.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"psirt@paloaltonetworks.com","type":"Secondary"}]}
|