« Volver al listado

CVE-2024-9470

Estado: AplazadaMedia (5.3)—

A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view the data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Paloaltonetworks — Cortex XsoarAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-9470",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-9470",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-10T17:40:29.962911Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@paloaltonetworks.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "AUTOMATIC",
          "baseScore": 5.3,
          "Automatable": "YES",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "AMBER",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.12.0:B857430:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.12.0:B661643:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.12.0:B493375:*:*:*:*:*:*",
            "cpe:2.3:a:paloaltonetworks:cortex_xsoar:6.12.0:-:*:*:*:*:*:*"
          ],
          "vendor": "Palo Alto Networks",
          "product": "Cortex XSOAR",
          "versions": [
            {
              "status": "unaffected",
              "version": "8.0.0"
            },
            {
              "status": "unaffected",
              "version": "6.13.0"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.12.0 (Build 1271551)",
                  "status": "unaffected"
                }
              ],
              "version": "6.12.0",
              "lessThan": "6.12.0 (Build 1271551)",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-10-09T17:15:20.907",
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2024-9470",
      "source": "psirt@paloaltonetworks.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@paloaltonetworks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view the data."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en Cortex XSOAR permite la divulgación de datos de incidentes a usuarios que no tienen el privilegio de ver los datos."
    }
  ],
  "lastModified": "2026-06-17T08:24:38.040",
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}