Login Request a demo
High severity · published Dec 9, 2020
CVE-2020-2049
A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory. This issue impacts: All versions of Cortex XDR Agent 7.1 with content update 149 and earlier versions; All versions of Cortex XDR Agent 7.2 with content update 149 and earlier versions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cortex Xdr Agent · Paloaltonetworks
7.1.1 through 7.1.3; 7.2.1 through 7.2.2; 7.1; 7.1; 7.2; 7.2 · source: NVD
Affected product
CX
Cortex Xdr Agent
Paloaltonetworks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-2049
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-2049
Vendor Advisory
https://security.paloaltonetworks.com/CVE-2020-2049
More from Cortex Xdr Agent
7.8
CVE-2023-0002
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or…
7.8
CVE-2022-0015
A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated…
7.8
CVE-2021-3042
A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute…
7.8
CVE-2021-3041
A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute…
7.3
CVE-2022-0014
An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory…