Security readout for executives and security teams
Plain-English summary
CVE-2021-3049 is a low-severity access-control flaw in Palo Alto Networks Cortex XSOAR. A logged-in user with investigation read permissions could download files from incident investigations they know about, even if they are not a participant. Business impact is limited but relevant where investigations contain sensitive evidence or customer data.
Executive priority
Handle through normal vulnerability management unless XSOAR investigations contain regulated, legal, or highly sensitive incident evidence. Prioritize permission review and upgrade planning over emergency response.
Technical view
The issue is improper authorization in Cortex XSOAR server incident investigations. It requires network access, low privileges, high attack complexity, and user interaction. Impact is limited to confidentiality. Affected versions are Cortex XSOAR 5.5.0 all builds and 6.1.0 builds earlier than 12099345; sources state 6.2.0 is not impacted.
Likely exposure
Exposure is limited to organizations running affected Cortex XSOAR versions with authenticated users who have investigation read permissions and awareness of specific investigations.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not listed as KEV. Exploitation requires authentication, permissions, awareness of the investigation, and user interaction.
Researcher notes
CVSS 3.1 score is 2.6: AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N. The bundle’s affected array includes 6.2.0, but the description states 6.2.0 is not impacted; rely on vendor advisory details.
Mitigation direction
- Identify any Cortex XSOAR 5.5.0 or vulnerable 6.1.0 deployments.
- Upgrade Cortex XSOAR 6.1.0 to build 12099345 or later.
- For Cortex XSOAR 5.5.0, check Palo Alto Networks guidance for the supported upgrade path.
- Restrict investigation read permissions to users with a clear operational need.
- Review access to investigations containing sensitive files or evidence.
Validation and detection
- Confirm deployed Cortex XSOAR version and build number.
- Verify whether any instance is 5.5.0 or 6.1.0 earlier than build 12099345.
- Review user roles with investigation read permissions.
- Check investigation access logs for unusual file downloads where logging is available.
- Confirm 6.2.0 deployments are not treated as affected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-3049 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N1.21.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
2.6LowVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://security.paloaltonetworks.com/CVE-2021-3049CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.