CVE-2023-3282: 
Cortex XSOAR vulnerability analysis and mitigation

A local privilege escalation (PE) vulnerability was discovered in the Palo Alto Networks Cortex XSOAR engine software running on Linux operating systems, identified as CVE-2023-3282. The vulnerability was disclosed on November 8, 2023, affecting Cortex XSOAR versions 6.10.x prior to 6.10.0.250144 on Linux systems (Palo Alto Advisory).

The vulnerability is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource) with a CVSS v3.1 base score of 6.7 (Medium) according to NVD, and 6.4 (Medium) according to Palo Alto Networks. The vulnerability specifically affects Cortex XSOAR engines installed through the shell method on Linux operating systems. The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating local access requirements with high privileges needed (NVD).

If exploited, this vulnerability allows a local attacker with shell access to the engine to execute programs with elevated privileges, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability (Palo Alto Advisory).

The vulnerability requires local access and high privileges for exploitation. Palo Alto Networks has stated they are not aware of any malicious exploitation of this issue in the wild (Palo Alto Advisory).

The vulnerability has been fixed in Cortex XSOAR 6.10 build B250144 and all later builds. Users should upgrade their Cortex XSOAR engines using an updated engine installer to remediate this vulnerability (Palo Alto Advisory).

The vulnerability was discovered and reported by Romeo Benzoni, with credit given by Palo Alto Networks for responsible disclosure (Palo Alto Advisory).