Cortex XDR on Ubuntu doesn't recognise vulnerabilities correctly

[Piotr_Kowalczyk]

Hi,

Cortex XDR agent (version 8.1.0.107064) installed on fully patched Ubuntu server 22.04 doesn’t recognise vulnerabilities correctly. It shows over 330 false positives.

Some examples below:

CVE-2015-34-5 – ntp vulnerable version prior 4.2.8p2-RC2 – recently installed 4.2.8p15

CVE-2019-13638 – patch vulnerable version 2.7.6 – recently installed 2.7.6-7build2 which has the CVE fixed.

CVE-2022-0318 – vim vulnerable version up to (excluding) 8.2.4151 – installed version: 8.2.4919

Could you help with this please?

[PiyushKohli · Accepted solution]

Hi @Piotr_Kowalczyk 

Thank you for writing to live community!

Cortex XDR calculates CVEs for applications according to the application version, and not according to application build numbers. 

Ref: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Vulnerabili... 

Hope this helps and clarifies!

Please mark the response as "Accept as Solution" if it answers your query.

[Piotr_Kowalczyk]

Thanks you for this information.

Although it explains the behaviour, sadly it makes the functionality useless.