{"id":"CVE-2022-0020","aliases":["EUVD-2022-15241","GHSA-p58g-823f-vq5p"],"status":"published","title":"Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface","description":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations. This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01711,"percentile":0.7753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2022-02-10T18:10:23Z","modified":"2026-06-17T04:19:54Z","exploits":[{"source":"exploitdb","id":"EDB-51343","title":"Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)","type":"webapps","platform":"multiple","date":"2023-04-08","url":"https://www.exploit-db.com/exploits/51343"}],"products":[{"vendor":"palo alto networks","product":"cortex xsoar"},{"vendor":"paloaltonetworks","product":"cortex_xsoar"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2022-0020","tags":["x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/171782/Palo-Alto-Cortex-XSOAR-6.5.0-Cross-Site-Scripting.html","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0020"},{"url":"https://github.com/advisories/GHSA-p58g-823f-vq5p"}],"sources":{"cve":[{"id":"CVE-2022-0020","title":"Cortex XSOAR: Stored Cross-Site Scripting (XSS) Vulnerability in Web Interface","description":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations. This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.","status":"published","published":"2022-02-10T18:10:23.382Z","modified":"2024-09-16T16:53:59.807Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-15241","description":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations. This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.","status":"published","published":"2022-02-10T18:10:23Z","modified":"2024-09-16T16:53:59Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T00:55:47.18954Z"}],"ghsa":[{"id":"GHSA-p58g-823f-vq5p","title":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface...","description":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations. This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.","status":"published","published":"2022-02-11T00:00:45Z","modified":"2023-04-18T05:07:03Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:30.910714Z"}],"nvd":[{"id":"CVE-2022-0020","description":"A stored cross-site scripting (XSS) vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators who encounter the payload during normal operations. This issue impacts: All builds of Cortex XSOAR 6.1.0; Cortex XSOAR 6.2.0 builds earlier than build 1958888.","status":"published","published":"2022-02-10T18:15:08.747Z","modified":"2026-06-17T04:19:54.13Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:12.155838Z"}]}}