« Volver al listado

CVE-2021-3041

Estado: ModificadaAlta (7.8)—

A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory or to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.11; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.8; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.3; All versions of Cortex XDR agent 7.2 without content update release 171 or a later version.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Paloaltonetworks — Cortex XDR Agent

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-3041",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@paloaltonetworks.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "Palo Alto Networks",
          "product": "Cortex XDR Agent",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "5.0.11",
                  "status": "unaffected"
                }
              ],
              "version": "5.0",
              "lessThan": "5.0.11",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.1.8",
                  "status": "unaffected"
                }
              ],
              "version": "6.1",
              "lessThan": "6.1.8",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "7.2.3 with content update 171 or later",
                  "status": "unaffected"
                }
              ],
              "version": "7.2",
              "lessThan": "7.2.3 or without content update 171 or later",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-10T13:15:08.420",
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2021-3041",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2021-3041",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@paloaltonetworks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the privilege to create files in the Windows root directory or to manipulate key registry values. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR agent 5.0.11; Cortex XDR agent 6.1 versions earlier than Cortex XDR agent 6.1.8; Cortex XDR agent 7.2 versions earlier than Cortex XDR agent 7.2.3; All versions of Cortex XDR agent 7.2 without content update release 171 or a later version."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de escalada de privilegios local en el agente Palo Alto Networks Cortex XDR agent en plataformas Windows que permite a un usuario local de Windows autenticado ejecutar programas con privilegios SYSTEM. Esto requiere que el usuario tenga el privilegio de crear archivos en el directorio root de Windows o de manipular valores clave del registro. Este problema afecta: Cortex XDR agent versiones 5.0 versiones anteriores a Cortex XDR agent 5.0.11; Cortex XDR agent  versiones 6.1 versiones anteriores a Cortex XDR agent 6.1.8; Cortex XDR agent versiones 7.2 versiones anteriores a Cortex XDR agent 7.2.3; Todas las versiones de Cortex XDR agent 7.2 sin la versión de actualización de contenidos 171 o una versión posterior"
    }
  ],
  "lastModified": "2026-06-17T04:04:36.817",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85F52B2D-FE23-48FA-9287-9ABEFCE6329D",
              "versionEndExcluding": "5.0.11",
              "versionStartIncluding": "5.0"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5968299F-4BEF-4595-95B0-C499847DF5A8",
              "versionEndExcluding": "6.1.8",
              "versionStartIncluding": "6.1"
            },
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:cortex_xdr_agent:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "607575B3-B1D1-4491-9C96-6721771AB28D",
              "versionEndExcluding": "7.2.3",
              "versionStartIncluding": "7.2"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}