CVE-2023-0003

Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server

6.5 Medium

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.33%Up 0.4 points since Feb 9, 2023

What each source reports

CVE List Score used6.5

Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

Record: CVE-2023-0003
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-73
Updated: 2026-11-02

EUVDEUVD-2023-121086.5

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

Record: EUVD-2023-12108
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rfc4-38hf-4pmp6.5

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an...

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

Record: GHSA-rfc4-38hf-4pmp
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-73, CWE-610
Updated: 2026-11-02

NVD6.5

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

Record: CVE-2023-0003
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-73, CWE-610
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-0003 is a medium vulnerability (CVSS 6.5) in Palo Alto Networks Cortex Xsoar, published February 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. No source names a fixed version.

References

Show 7 moreShow less