CVE-2024-5905: Cortex XDR Agent: Local Windows User Can Disrupt Functionality of the Agent
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some functionality of the agent. However, they are not able to disrupt Cortex XDR agent protection mechanisms using this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks Cortex XDR Agent (Windows)to a version that resolves this vulnerability.Fixed in 7.9.102-CE - Upgrade
Upgrade
Palo Alto Networks Cortex XDR Agent (Windows)to a version that resolves this vulnerability.Fixed in 8.1.2 - Upgrade
Upgrade
Palo Alto Networks Cortex XDR Agent (Windows)to a version that resolves this vulnerability.Fixed in 8.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5905?
CVE-2024-5905 has a medium severity level due to the potential disruption of Cortex XDR agent functionality.
How do I fix CVE-2024-5905?
To mitigate CVE-2024-5905, update the Cortex XDR agent to a version above 7.9.102, 8.1.2, or 8.2.1.
Which versions of Cortex XDR agent are affected by CVE-2024-5905?
CVE-2024-5905 affects versions 7.9.0 to 7.9.102, 8.1.0 to 8.1.2, and 8.2.0 to 8.2.1 of the Cortex XDR agent.
Can a low privileged user exploit CVE-2024-5905?
Yes, a local low privileged Windows user can disrupt some functionalities of the Cortex XDR agent through CVE-2024-5905.
Will the protection mechanisms of Cortex XDR agent be affected by CVE-2024-5905?
No, while CVE-2024-5905 allows disruption of certain functionalities, it does not affect the core protection mechanisms of the Cortex XDR agent.