CVE-2023-0003: 
Cortex XSOAR vulnerability analysis and mitigation

A file disclosure vulnerability (CVE-2023-0003) was identified in the Palo Alto Networks Cortex XSOAR server software. The vulnerability was disclosed on February 8, 2023, affecting multiple versions of Cortex XSOAR prior to version-specific security patches (NVD, Palo Alto Advisory).

The vulnerability enables an authenticated user with access to the web interface to read local files from the server. It has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-73 (External Control of File Name or Path) and CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) (NVD).

The vulnerability allows authenticated users to read arbitrary local files from the Cortex XSOAR server, potentially exposing sensitive information stored on the system (Palo Alto Advisory).

Palo Alto Networks has reported that they are not aware of any malicious exploitation of this vulnerability in the wild (Palo Alto Advisory).

The vulnerability has been fixed in Cortex XSOAR 6.6 build B186115, Cortex XSOAR 6.8 build B185719, Cortex XSOAR 6.9 build B185415, Cortex XSOAR 6.10 build 185964, and all later builds. Users are advised to upgrade to these patched versions. There are no known workarounds for this issue (Palo Alto Advisory).