Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    434 vulnerabilities found for PAN-OS by Palo Alto Networks

    CERTFR-2019-AVI-607

    Vulnerability from certfr_avis - Published: - Updated:

    Une vulnérabilité a été découverte dans Palo Alto PAN-OS. Elle permet à un attaquant de provoquer une élévation de privilèges.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Palo Alto Networks PAN-OS Palo Alto PAN-OS versions antérieures à 7.1.25
    Palo Alto Networks PAN-OS Palo Alto PAN-OS versions 8.1.x antérieures à 8.1.11
    Palo Alto Networks PAN-OS Palo Alto PAN-OS versions 8.0.x antérieures à 8.0.20
    Palo Alto Networks PAN-OS Palo Alto PAN-OS versions 9.0.x antérieures à 9.0.5
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Palo Alto PAN-OS versions ant\u00e9rieures \u00e0 7.1.25",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Palo Alto PAN-OS versions 8.1.x ant\u00e9rieures \u00e0 8.1.11",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Palo Alto PAN-OS versions 8.0.x ant\u00e9rieures \u00e0 8.0.20",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "Palo Alto PAN-OS versions 9.0.x ant\u00e9rieures \u00e0 9.0.5",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-17437",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-17437"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-607",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-12-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Palo Alto PAN-OS. Elle permet \u00e0\nun attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Palo Alto PAN-OS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto du 04 d\u00e9cembre 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/201"
    }
  ]
}

    CERTFR-2019-AVI-408

    Vulnerability from certfr_avis - Published: - Updated:

    De multiples vulnérabilités ont été découvertes dans Palo Alto PAN-OS. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Palo Alto Networks PAN-OS PAN-OS versions 9.0.x antérieures à 9.0.3-h3
    Palo Alto Networks PAN-OS PAN-OS versions 8.0.x antérieures à 8.0.19-h1
    Palo Alto Networks PAN-OS PAN-OS versions 8.1.x antérieures à 8.1.9-h4
    Palo Alto Networks PAN-OS PAN-OS versions antérieures à 7.1.24-h1
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "PAN-OS versions 9.0.x ant\u00e9rieures \u00e0 9.0.3-h3",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 8.0.x ant\u00e9rieures \u00e0 8.0.19-h1",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 8.1.x ant\u00e9rieures \u00e0 8.1.9-h4",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions ant\u00e9rieures \u00e0 7.1.24-h1",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-1581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1581"
    },
    {
      "name": "CVE-2019-1580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1580"
    },
    {
      "name": "CVE-2019-1582",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1582"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-408",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-08-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Palo Alto PAN-OS.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Palo Alto PAN-OS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 160 du 21 ao\u00fbt 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/160"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 159 du 21 ao\u00fbt 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/159"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 161 du 21 ao\u00fbt 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/161"
    }
  ]
}

    CERTFR-2019-AVI-350

    Vulnerability from certfr_avis - Published: - Updated:

    Une vulnérabilité a été découverte dans Palo Alto PAN-OS. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Palo Alto Networks PAN-OS PAN-OS versions antérieures à 7.1.19
    Palo Alto Networks PAN-OS PAN-OS versions 8.1.x antérieures à 8.1.3
    Palo Alto Networks PAN-OS PAN-OS versions 8.0.x antérieures à 8.0.12
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "PAN-OS versions ant\u00e9rieures \u00e0 7.1.19",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 8.1.x ant\u00e9rieures \u00e0 8.1.3",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 8.0.x ant\u00e9rieures \u00e0 8.0.12",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-1579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1579"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-350",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-07-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Palo Alto PAN-OS. Elle permet \u00e0\nun attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Palo Alto PAN-OS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 158 du 18 juillet 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/158"
    }
  ]
}

    CERTFR-2019-AVI-335

    Vulnerability from certfr_avis - Published: - Updated:

    De multiples vulnérabilités ont été découvertes dans Palo Alto PAN-OS. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une élévation de privilèges.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Palo Alto Networks PAN-OS PAN-OS versions 8.0.x antérieures à 8.0.19
    Palo Alto Networks PAN-OS PAN-OS versions antérieures à 7.1.24
    Palo Alto Networks PAN-OS PAN-OS versions 8.1.x antérieures à 8.1.8-h5
    Palo Alto Networks PAN-OS PAN-OS versions 9.0.x antérieures à 9.0.2-h4
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "PAN-OS versions 8.0.x ant\u00e9rieures \u00e0 8.0.19",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions ant\u00e9rieures \u00e0 7.1.24",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 8.1.x ant\u00e9rieures \u00e0 8.1.8-h5",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 9.0.x ant\u00e9rieures \u00e0 9.0.2-h4",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-1576",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1576"
    },
    {
      "name": "CVE-2019-1575",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1575"
    },
    {
      "name": "CVE-2019-8912",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-8912"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-335",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-07-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Palo Alto PAN-OS.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et\nune \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Palo Alto PAN-OS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 156 du 15 juillet 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/156"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 157 du 15 juillet 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/157"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 155 du 15 juillet 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/155"
    }
  ]
}

    CERTFR-2019-AVI-298

    Vulnerability from certfr_avis - Published: - Updated:

    De multiples vulnérabilités ont été découvertes dans les produits Palo Alto. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une injection de code indirecte à distance (XSS).

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    N/A N/A Traps versions antérieures à 5.0.5
    Palo Alto Networks PAN-OS PAN-OS versions 8.0.x antérieures à 8.0.19
    Palo Alto Networks PAN-OS PAN-OS versions antérieures à 7.1.24
    Palo Alto Networks PAN-OS PAN-OS versions 8.1.x antérieures à 8.1.8-h5
    Palo Alto Networks PAN-OS PAN-OS versions 9.0.x antérieures à 9.0.2-h4
    Palo Alto Networks N/A MineMeld versions antérieures à 0.9.62
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Traps versions ant\u00e9rieures \u00e0 5.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 8.0.x ant\u00e9rieures \u00e0 8.0.19",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions ant\u00e9rieures \u00e0 7.1.24",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 8.1.x ant\u00e9rieures \u00e0 8.1.8-h5",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "PAN-OS versions 9.0.x ant\u00e9rieures \u00e0 9.0.2-h4",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    },
    {
      "description": "MineMeld versions ant\u00e9rieures \u00e0 0.9.62",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-1577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1577"
    },
    {
      "name": "CVE-2019-11478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11478"
    },
    {
      "name": "CVE-2019-5599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5599"
    },
    {
      "name": "CVE-2019-1578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1578"
    },
    {
      "name": "CVE-2019-11479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11479"
    },
    {
      "name": "CVE-2019-11477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11477"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-298",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-06-28T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Palo\nAlto. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une injection de\ncode indirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Palo Alto",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 153 du 27 juin 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/153"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 151 du 27 juin 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/151"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Palo Alto 152 du 27 juin 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/152"
    }
  ]
}

    CERTFR-2019-AVI-134

    Vulnerability from certfr_avis - Published: - Updated:

    Une vulnérabilité a été découverte dans PaloAlto PAN-OS. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité et une atteinte à la confidentialité des données.

    Solution

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    None
    Impacted products
    Vendor Product Description
    Palo Alto Networks PAN-OS PaloAlto PAN-OS version 9.0.0
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "PaloAlto PAN-OS version 9.0.0",
      "product": {
        "name": "PAN-OS",
        "vendor": {
          "name": "Palo Alto Networks",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-1572",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-1572"
    }
  ],
  "links": [],
  "reference": "CERTFR-2019-AVI-134",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-03-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans PaloAlto PAN-OS. Elle permet \u00e0\nun attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9\net une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans PaloAlto PAN-OS",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 PaloAlto PAN-113675 du 28 mars 2019",
      "url": "https://securityadvisories.paloaltonetworks.com/Home/Detail/145"
    }
  ]
}

    CVE-2019-1581 (GCVE-0-2019-1581)

    Vulnerability from cvelistv5 – Published: 2019-08-23 17:06 – Updated: 2024-09-17 00:56
    VLAI
    Title
    PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface
    Summary
    A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-78 - OS Command Injection
    Assigner
    References
    Impacted products
    Vendor Product Version
    Palo Alto Networks PAN-OS Affected: 7.1 , < 7.1.24-h1, 7.1.25 (custom)
    Affected: 8.0 , < 8.0.19-h1, 8.0.20 (custom)
    Affected: 8.1 , < 8.1.9-h4, 8.1.10 (custom)
    Affected: 9.0 , < 9.0.3-h3, 9.0.4 (custom)
    Unknown: all , ≤ 7.0 (custom)
    		Create a notification for this product.
    Date Public
    2019-08-21 00:00
    Credits
    The UK's National Cyber Security Centre (NCSC)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:20:28.293Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2019-1581"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "lessThan": "7.1.24-h1, 7.1.25",
              "status": "affected",
              "version": "7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.19-h1, 8.0.20",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.1.9-h4, 8.1.10",
              "status": "affected",
              "version": "8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.3-h3, 9.0.4",
              "status": "affected",
              "version": "9.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "7.0",
              "status": "unknown",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The UK\u0027s National Cyber Security Centre (NCSC)"
        }
      ],
      "datePublic": "2019-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:48.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2019-1581"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue has been resolved in PAN-OS 7.1.24-h1 and later, PAN-OS 8.0.19-h1 and later, PAN-OS 8.1.9-h4 and later, and PAN-OS 9.0.3-h3 and later."
        }
      ],
      "source": {
        "advisory": "PAN-SA-2019-0022",
        "defect": [
          "PAN-123564"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface",
      "workarounds": [
        {
          "lang": "en",
          "value": "This issue affects the SSH management interface of PAN-OS and is strongly mitigated by following best practices for securing the PAN-OS management interfaces. Our best practices guidelines reduce the exposure of device management interfaces to potential attacker."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2019-08-21T22:13:00.000Z",
          "ID": "CVE-2019-1581",
          "STATE": "PUBLIC",
          "TITLE": "PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PAN-OS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "7.1",
                            "version_value": "7.1.24-h1, 7.1.25"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "8.0",
                            "version_value": "8.0.19-h1, 8.0.20"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "8.1",
                            "version_value": "8.1.9-h4, 8.1.10"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "9.0",
                            "version_value": "9.0.3-h3, 9.0.4"
                          },
                          {
                            "version_affected": "?\u003c=",
                            "version_name": "all",
                            "version_value": "7.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "The UK\u0027s National Cyber Security Centre (NCSC)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78 OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2019-1581",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2019-1581"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "This issue has been resolved in PAN-OS 7.1.24-h1 and later, PAN-OS 8.0.19-h1 and later, PAN-OS 8.1.9-h4 and later, and PAN-OS 9.0.3-h3 and later."
          }
        ],
        "source": {
          "advisory": "PAN-SA-2019-0022",
          "defect": [
            "PAN-123564"
          ],
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "This issue affects the SSH management interface of PAN-OS and is strongly mitigated by following best practices for securing the PAN-OS management interfaces. Our best practices guidelines reduce the exposure of device management interfaces to potential attacker."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2019-1581",
    "datePublished": "2019-08-23T17:06:23.679Z",
    "dateReserved": "2018-12-06T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:56:45.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-1572 (GCVE-0-2019-1572)

    Vulnerability from cvelistv5 – Published: 2019-03-26 21:48 – Updated: 2024-08-04 18:20
    VLAI
    Summary
    PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.
    Severity
    No CVSS data available.
    CWE
    • Other
    Assigner
    References
    Impacted products
    Vendor Product Version
    Palo Alto Networks PAN-OS Affected: PAN-OS 9.0.0
    		Create a notification for this product.
    Date Public
    2019-03-12 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:20:28.281Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "107720",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107720"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2019-1572"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "affected",
              "version": "PAN-OS 9.0.0"
            }
          ]
        }
      ],
      "datePublic": "2019-03-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:48.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "name": "107720",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107720"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2019-1572"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "ID": "CVE-2019-1572",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PAN-OS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "PAN-OS 9.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "107720",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107720"
            },
            {
              "name": "https://security.paloaltonetworks.com/CVE-2019-1572",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2019-1572"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2019-1572",
    "datePublished": "2019-03-26T21:48:35.000Z",
    "dateReserved": "2018-12-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T18:20:28.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-10139 (GCVE-0-2018-10139)

    Vulnerability from cvelistv5 – Published: 2018-08-16 18:00 – Updated: 2024-09-17 01:25
    VLAI
    Summary
    The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.
    Severity
    No CVSS data available.
    CWE
    • Cross-site scripting
    Assigner
    References
    URL Tags
    http://www.securityfocus.com/bid/105111 vdb-entryx_refsource_BID
    http://www.securitytracker.com/id/1041544 vdb-entryx_refsource_SECTRACK
    https://security.paloaltonetworks.com/CVE-2018-10139 x_refsource_CONFIRM
    Impacted products
    Vendor Product Version
    Palo Alto Networks PAN-OS Affected: 6.1.21 and earlier
    Affected: 7.1.18 and earlier
    Affected: 8.0.11 and earlier
    		Create a notification for this product.
    Date Public
    2018-08-15 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:32:01.237Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105111",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105111"
          },
          {
            "name": "1041544",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041544"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2018-10139"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.21 and earlier"
            },
            {
              "status": "affected",
              "version": "7.1.18 and earlier"
            },
            {
              "status": "affected",
              "version": "8.0.11 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-08-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:46.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "name": "105111",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105111"
        },
        {
          "name": "1041544",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041544"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2018-10139"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2018-08-15T00:00:00",
          "ID": "CVE-2018-10139",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PAN-OS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.1.21 and earlier"
                          },
                          {
                            "version_value": "7.1.18 and earlier"
                          },
                          {
                            "version_value": "8.0.11 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105111",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105111"
            },
            {
              "name": "1041544",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041544"
            },
            {
              "name": "https://security.paloaltonetworks.com/CVE-2018-10139",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2018-10139"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2018-10139",
    "datePublished": "2018-08-16T18:00:00.000Z",
    "dateReserved": "2018-04-16T00:00:00.000Z",
    "dateUpdated": "2024-09-17T01:25:36.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-10140 (GCVE-0-2018-10140)

    Vulnerability from cvelistv5 – Published: 2018-08-16 18:00 – Updated: 2024-09-16 18:39
    VLAI
    Summary
    The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.
    Severity
    No CVSS data available.
    CWE
    • Denial of Service
    Assigner
    References
    URL Tags
    http://www.securityfocus.com/bid/105107 vdb-entryx_refsource_BID
    http://www.securitytracker.com/id/1041545 vdb-entryx_refsource_SECTRACK
    https://security.paloaltonetworks.com/CVE-2018-10140 x_refsource_CONFIRM
    Impacted products
    Vendor Product Version
    Palo Alto Networks PAN-OS Affected: 8.1.2 and earlier
    		Create a notification for this product.
    Date Public
    2018-08-15 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:32:01.444Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105107",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105107"
          },
          {
            "name": "1041545",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041545"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2018-10140"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "affected",
              "version": "8.1.2 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-08-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:46.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "name": "105107",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105107"
        },
        {
          "name": "1041545",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041545"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2018-10140"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2018-08-15T00:00:00",
          "ID": "CVE-2018-10140",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PAN-OS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "8.1.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105107",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105107"
            },
            {
              "name": "1041545",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041545"
            },
            {
              "name": "https://security.paloaltonetworks.com/CVE-2018-10140",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2018-10140"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2018-10140",
    "datePublished": "2018-08-16T18:00:00.000Z",
    "dateReserved": "2018-04-16T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:39:24.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-1581 (GCVE-0-2019-1581)

    Vulnerability from nvd – Published: 2019-08-23 17:06 – Updated: 2024-09-17 00:56
    VLAI
    Title
    PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface
    Summary
    A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4.
    Severity
    9.8 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-78 - OS Command Injection
    Assigner
    References
    Impacted products
    Vendor Product Version
    Palo Alto Networks PAN-OS Affected: 7.1 , < 7.1.24-h1, 7.1.25 (custom)
    Affected: 8.0 , < 8.0.19-h1, 8.0.20 (custom)
    Affected: 8.1 , < 8.1.9-h4, 8.1.10 (custom)
    Affected: 9.0 , < 9.0.3-h3, 9.0.4 (custom)
    Unknown: all , ≤ 7.0 (custom)
    		Create a notification for this product.
    Date Public
    2019-08-21 00:00
    Credits
    The UK's National Cyber Security Centre (NCSC)
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:20:28.293Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2019-1581"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "lessThan": "7.1.24-h1, 7.1.25",
              "status": "affected",
              "version": "7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.19-h1, 8.0.20",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "8.1.9-h4, 8.1.10",
              "status": "affected",
              "version": "8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.3-h3, 9.0.4",
              "status": "affected",
              "version": "9.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "7.0",
              "status": "unknown",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The UK\u0027s National Cyber Security Centre (NCSC)"
        }
      ],
      "datePublic": "2019-08-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:48.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2019-1581"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "This issue has been resolved in PAN-OS 7.1.24-h1 and later, PAN-OS 8.0.19-h1 and later, PAN-OS 8.1.9-h4 and later, and PAN-OS 9.0.3-h3 and later."
        }
      ],
      "source": {
        "advisory": "PAN-SA-2019-0022",
        "defect": [
          "PAN-123564"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface",
      "workarounds": [
        {
          "lang": "en",
          "value": "This issue affects the SSH management interface of PAN-OS and is strongly mitigated by following best practices for securing the PAN-OS management interfaces. Our best practices guidelines reduce the exposure of device management interfaces to potential attacker."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2019-08-21T22:13:00.000Z",
          "ID": "CVE-2019-1581",
          "STATE": "PUBLIC",
          "TITLE": "PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PAN-OS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "7.1",
                            "version_value": "7.1.24-h1, 7.1.25"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "8.0",
                            "version_value": "8.0.19-h1, 8.0.20"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "8.1",
                            "version_value": "8.1.9-h4, 8.1.10"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "9.0",
                            "version_value": "9.0.3-h3, 9.0.4"
                          },
                          {
                            "version_affected": "?\u003c=",
                            "version_name": "all",
                            "version_value": "7.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "The UK\u0027s National Cyber Security Centre (NCSC)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to 7.1.24-h1, 7.1.25; 8.0 versions prior to 8.0.19-h1, 8.0.20; 8.1 versions prior to 8.1.9-h4, 8.1.10; 9.0 versions prior to 9.0.3-h3, 9.0.4."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78 OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://security.paloaltonetworks.com/CVE-2019-1581",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2019-1581"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "This issue has been resolved in PAN-OS 7.1.24-h1 and later, PAN-OS 8.0.19-h1 and later, PAN-OS 8.1.9-h4 and later, and PAN-OS 9.0.3-h3 and later."
          }
        ],
        "source": {
          "advisory": "PAN-SA-2019-0022",
          "defect": [
            "PAN-123564"
          ],
          "discovery": "EXTERNAL"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "This issue affects the SSH management interface of PAN-OS and is strongly mitigated by following best practices for securing the PAN-OS management interfaces. Our best practices guidelines reduce the exposure of device management interfaces to potential attacker."
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2019-1581",
    "datePublished": "2019-08-23T17:06:23.679Z",
    "dateReserved": "2018-12-06T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:56:45.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2019-1572 (GCVE-0-2019-1572)

    Vulnerability from nvd – Published: 2019-03-26 21:48 – Updated: 2024-08-04 18:20
    VLAI
    Summary
    PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.
    Severity
    No CVSS data available.
    CWE
    • Other
    Assigner
    References
    Impacted products
    Vendor Product Version
    Palo Alto Networks PAN-OS Affected: PAN-OS 9.0.0
    		Create a notification for this product.
    Date Public
    2019-03-12 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:20:28.281Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "107720",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107720"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2019-1572"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "affected",
              "version": "PAN-OS 9.0.0"
            }
          ]
        }
      ],
      "datePublic": "2019-03-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:48.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "name": "107720",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107720"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2019-1572"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "ID": "CVE-2019-1572",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PAN-OS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "PAN-OS 9.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "107720",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107720"
            },
            {
              "name": "https://security.paloaltonetworks.com/CVE-2019-1572",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2019-1572"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2019-1572",
    "datePublished": "2019-03-26T21:48:35.000Z",
    "dateReserved": "2018-12-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T18:20:28.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-10139 (GCVE-0-2018-10139)

    Vulnerability from nvd – Published: 2018-08-16 18:00 – Updated: 2024-09-17 01:25
    VLAI
    Summary
    The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.
    Severity
    No CVSS data available.
    CWE
    • Cross-site scripting
    Assigner
    References
    URL Tags
    http://www.securityfocus.com/bid/105111 vdb-entryx_refsource_BID
    http://www.securitytracker.com/id/1041544 vdb-entryx_refsource_SECTRACK
    https://security.paloaltonetworks.com/CVE-2018-10139 x_refsource_CONFIRM
    Impacted products
    Vendor Product Version
    Palo Alto Networks PAN-OS Affected: 6.1.21 and earlier
    Affected: 7.1.18 and earlier
    Affected: 8.0.11 and earlier
    		Create a notification for this product.
    Date Public
    2018-08-15 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:32:01.237Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105111",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105111"
          },
          {
            "name": "1041544",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041544"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2018-10139"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.21 and earlier"
            },
            {
              "status": "affected",
              "version": "7.1.18 and earlier"
            },
            {
              "status": "affected",
              "version": "8.0.11 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-08-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:46.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "name": "105111",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105111"
        },
        {
          "name": "1041544",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041544"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2018-10139"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2018-08-15T00:00:00",
          "ID": "CVE-2018-10139",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PAN-OS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.1.21 and earlier"
                          },
                          {
                            "version_value": "7.1.18 and earlier"
                          },
                          {
                            "version_value": "8.0.11 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105111",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105111"
            },
            {
              "name": "1041544",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041544"
            },
            {
              "name": "https://security.paloaltonetworks.com/CVE-2018-10139",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2018-10139"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2018-10139",
    "datePublished": "2018-08-16T18:00:00.000Z",
    "dateReserved": "2018-04-16T00:00:00.000Z",
    "dateUpdated": "2024-09-17T01:25:36.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2018-10140 (GCVE-0-2018-10140)

    Vulnerability from nvd – Published: 2018-08-16 18:00 – Updated: 2024-09-16 18:39
    VLAI
    Summary
    The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.
    Severity
    No CVSS data available.
    CWE
    • Denial of Service
    Assigner
    References
    URL Tags
    http://www.securityfocus.com/bid/105107 vdb-entryx_refsource_BID
    http://www.securitytracker.com/id/1041545 vdb-entryx_refsource_SECTRACK
    https://security.paloaltonetworks.com/CVE-2018-10140 x_refsource_CONFIRM
    Impacted products
    Vendor Product Version
    Palo Alto Networks PAN-OS Affected: 8.1.2 and earlier
    		Create a notification for this product.
    Date Public
    2018-08-15 00:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:32:01.444Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105107",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105107"
          },
          {
            "name": "1041545",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041545"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2018-10140"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "affected",
              "version": "8.1.2 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2018-08-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:46.000Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "name": "105107",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105107"
        },
        {
          "name": "1041545",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041545"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2018-10140"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@paloaltonetworks.com",
          "DATE_PUBLIC": "2018-08-15T00:00:00",
          "ID": "CVE-2018-10140",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PAN-OS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "8.1.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Palo Alto Networks"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105107",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105107"
            },
            {
              "name": "1041545",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041545"
            },
            {
              "name": "https://security.paloaltonetworks.com/CVE-2018-10140",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2018-10140"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2018-10140",
    "datePublished": "2018-08-16T18:00:00.000Z",
    "dateReserved": "2018-04-16T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:39:24.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}