cve-2022-0022
Vulnerability from cvelistv5
Published
2022-03-09 17:35
Modified
2024-09-16 20:47
Severity ?
4.1 (Medium) - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Summary
Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7.
References
psirt@paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2022-0022Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.paloaltonetworks.com/CVE-2022-0022Vendor Advisory
Impacted products
Vendor Product Version
Palo Alto Networks PAN-OS Version: 9.0.*
Version: 9.1   < 9.1.11
Version: 8.1   < 8.1.21
Version: 10.0   < 10.0.7
 Create a notification for this product.
   Palo Alto Networks Prisma Access Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T23:18:41.475Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://security.paloaltonetworks.com/CVE-2022-0022",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "PAN-OS",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "10.1.*",
                  },
                  {
                     status: "affected",
                     version: "9.0.*",
                  },
                  {
                     status: "unaffected",
                     version: "10.2.*",
                  },
                  {
                     changes: [
                        {
                           at: "9.1.11",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "9.1.11",
                     status: "affected",
                     version: "9.1",
                     versionType: "custom",
                  },
                  {
                     changes: [
                        {
                           at: "8.1.21",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "8.1.21",
                     status: "affected",
                     version: "8.1",
                     versionType: "custom",
                  },
                  {
                     changes: [
                        {
                           at: "10.0.7",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "10.0.7",
                     status: "affected",
                     version: "10.0",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Prisma Access",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "3.0 Preferred, Innovation",
                  },
                  {
                     status: "unaffected",
                     version: "2.2 Preferred",
                  },
                  {
                     status: "unaffected",
                     version: "2.1 Preferred, Innovation",
                  },
               ],
            },
         ],
         configurations: [
            {
               lang: "en",
               value: "This issue is applicable only to PAN-OS firewalls and Panorama appliances running in normal (non-FIPS-CC) operational mode. PAN-OS software is not affected by this issue when running in FIPS-CC mode.",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Palo Alto Networks thanks an external security researcher for discovering and reporting this issue.",
            },
         ],
         datePublic: "2022-03-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 4.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-916",
                     description: "CWE-916 Use of Password Hash With Insufficient Computational Effort",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-09T17:35:09",
            orgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
            shortName: "palo_alto",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://security.paloaltonetworks.com/CVE-2022-0022",
            },
         ],
         solutions: [
            {
               lang: "en",
               value: "This issue is fixed in PAN-OS 8.1.21, PAN-OS 9.1.11, PAN-OS 10.0.7, and all later PAN-OS versions.\n\nThe passwords for all existing local user and administrator accounts must be changed after PAN-OS is upgraded to a fixed version to leverage the more secure cryptography for password hashes. You cannot update existing password hashes. All new local user and administrator accounts will use secure cryptography.\n\nPAN-OS 9.0 is end-of-life as of March 1, 2022, and is no longer covered by our Product Security Assurance policies.",
            },
         ],
         source: {
            defect: [
               "PAN-127479",
            ],
            discovery: "EXTERNAL",
         },
         timeline: [
            {
               lang: "en",
               time: "2022-03-09T00:00:00",
               value: "Initial publication",
            },
         ],
         title: "PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes",
         workarounds: [
            {
               lang: "en",
               value: "Ensure that any exported firewall configuration files are secured and that only trusted users have firewall management access to prevent the exposure of password hashes.\nUsing complex and secure passwords for all administrator and local user accounts makes password cracking infeasible and mitigates the impact of this issue.\n \nSwitching PAN-OS software from normal mode to FIPS-CC mode ensures that appliances use secure cryptography to store hashed credentials for all local user accounts. However, when you enable FIPS-CC mode, the appliance will reset to the factory default settings and the existing configuration is removed.\n\nDocumentation to enable FIPS-CC mode is available here:\nhttps://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certifications/enable-fips-and-common-criteria-support.html",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@paloaltonetworks.com",
               DATE_PUBLIC: "2022-03-09T17:00:00.000Z",
               ID: "CVE-2022-0022",
               STATE: "PUBLIC",
               TITLE: "PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "PAN-OS",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_name: "9.1",
                                          version_value: "9.1.11",
                                       },
                                       {
                                          version_affected: "<",
                                          version_name: "8.1",
                                          version_value: "8.1.21",
                                       },
                                       {
                                          version_affected: "<",
                                          version_name: "10.0",
                                          version_value: "10.0.7",
                                       },
                                       {
                                          version_affected: "!>=",
                                          version_name: "9.1",
                                          version_value: "9.1.11",
                                       },
                                       {
                                          version_affected: "!>=",
                                          version_name: "8.1",
                                          version_value: "8.1.21",
                                       },
                                       {
                                          version_affected: "!>=",
                                          version_name: "10.0",
                                          version_value: "10.0.7",
                                       },
                                       {
                                          version_affected: "!",
                                          version_name: "10.1",
                                          version_value: "10.1.*",
                                       },
                                       {
                                          version_affected: "=",
                                          version_name: "9.0",
                                          version_value: "9.0.*",
                                       },
                                       {
                                          version_affected: "!",
                                          version_name: "10.2",
                                          version_value: "10.2.*",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Prisma Access",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "!",
                                          version_name: "3.0",
                                          version_value: "Preferred, Innovation",
                                       },
                                       {
                                          version_affected: "!",
                                          version_name: "2.2",
                                          version_value: "Preferred",
                                       },
                                       {
                                          version_affected: "!",
                                          version_name: "2.1",
                                          version_value: "Preferred, Innovation",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Palo Alto Networks",
                     },
                  ],
               },
            },
            configuration: [
               {
                  lang: "en",
                  value: "This issue is applicable only to PAN-OS firewalls and Panorama appliances running in normal (non-FIPS-CC) operational mode. PAN-OS software is not affected by this issue when running in FIPS-CC mode.",
               },
            ],
            credit: [
               {
                  lang: "eng",
                  value: "Palo Alto Networks thanks an external security researcher for discovering and reporting this issue.",
               },
            ],
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7.",
                  },
               ],
            },
            exploit: [
               {
                  lang: "en",
                  value: "Palo Alto Networks is not aware of any malicious exploitation of this issue.",
               },
            ],
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            impact: {
               cvss: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 4.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-916 Use of Password Hash With Insufficient Computational Effort",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://security.paloaltonetworks.com/CVE-2022-0022",
                     refsource: "MISC",
                     url: "https://security.paloaltonetworks.com/CVE-2022-0022",
                  },
               ],
            },
            solution: [
               {
                  lang: "en",
                  value: "This issue is fixed in PAN-OS 8.1.21, PAN-OS 9.1.11, PAN-OS 10.0.7, and all later PAN-OS versions.\n\nThe passwords for all existing local user and administrator accounts must be changed after PAN-OS is upgraded to a fixed version to leverage the more secure cryptography for password hashes. You cannot update existing password hashes. All new local user and administrator accounts will use secure cryptography.\n\nPAN-OS 9.0 is end-of-life as of March 1, 2022, and is no longer covered by our Product Security Assurance policies.",
               },
            ],
            source: {
               defect: [
                  "PAN-127479",
               ],
               discovery: "EXTERNAL",
            },
            timeline: [
               {
                  lang: "en",
                  time: "2022-03-09T00:00:00",
                  value: "Initial publication",
               },
            ],
            work_around: [
               {
                  lang: "en",
                  value: "Ensure that any exported firewall configuration files are secured and that only trusted users have firewall management access to prevent the exposure of password hashes.\nUsing complex and secure passwords for all administrator and local user accounts makes password cracking infeasible and mitigates the impact of this issue.\n \nSwitching PAN-OS software from normal mode to FIPS-CC mode ensures that appliances use secure cryptography to store hashed credentials for all local user accounts. However, when you enable FIPS-CC mode, the appliance will reset to the factory default settings and the existing configuration is removed.\n\nDocumentation to enable FIPS-CC mode is available here:\nhttps://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certifications/enable-fips-and-common-criteria-support.html",
               },
            ],
            x_advisoryEoL: false,
            x_affectedList: [
               "PAN-OS 10.0.6",
               "PAN-OS 10.0.5",
               "PAN-OS 10.0.4",
               "PAN-OS 10.0.3",
               "PAN-OS 10.0.2",
               "PAN-OS 10.0.1",
               "PAN-OS 10.0.0",
               "PAN-OS 10.0",
               "PAN-OS 9.1.10",
               "PAN-OS 9.1.9",
               "PAN-OS 9.1.8",
               "PAN-OS 9.1.7",
               "PAN-OS 9.1.6",
               "PAN-OS 9.1.5",
               "PAN-OS 9.1.4",
               "PAN-OS 9.1.3-h1",
               "PAN-OS 9.1.3",
               "PAN-OS 9.1.2-h1",
               "PAN-OS 9.1.2",
               "PAN-OS 9.1.1",
               "PAN-OS 9.1.0-h3",
               "PAN-OS 9.1.0-h2",
               "PAN-OS 9.1.0-h1",
               "PAN-OS 9.1.0",
               "PAN-OS 9.1",
               "PAN-OS 9.0.16",
               "PAN-OS 9.0.15",
               "PAN-OS 9.0.14-h4",
               "PAN-OS 9.0.14-h3",
               "PAN-OS 9.0.14-h2",
               "PAN-OS 9.0.14-h1",
               "PAN-OS 9.0.14",
               "PAN-OS 9.0.13",
               "PAN-OS 9.0.12",
               "PAN-OS 9.0.11",
               "PAN-OS 9.0.10",
               "PAN-OS 9.0.9-h1",
               "PAN-OS 9.0.9",
               "PAN-OS 9.0.8",
               "PAN-OS 9.0.7",
               "PAN-OS 9.0.6",
               "PAN-OS 9.0.5",
               "PAN-OS 9.0.4",
               "PAN-OS 9.0.3-h3",
               "PAN-OS 9.0.3-h2",
               "PAN-OS 9.0.3-h1",
               "PAN-OS 9.0.3",
               "PAN-OS 9.0.2-h4",
               "PAN-OS 9.0.2-h3",
               "PAN-OS 9.0.2-h2",
               "PAN-OS 9.0.2-h1",
               "PAN-OS 9.0.2",
               "PAN-OS 9.0.1",
               "PAN-OS 9.0.0",
               "PAN-OS 9.0",
               "PAN-OS 8.1.20-h1",
               "PAN-OS 8.1.20",
               "PAN-OS 8.1.19",
               "PAN-OS 8.1.18",
               "PAN-OS 8.1.17",
               "PAN-OS 8.1.16",
               "PAN-OS 8.1.15-h3",
               "PAN-OS 8.1.15-h2",
               "PAN-OS 8.1.15-h1",
               "PAN-OS 8.1.15",
               "PAN-OS 8.1.14-h2",
               "PAN-OS 8.1.14-h1",
               "PAN-OS 8.1.14",
               "PAN-OS 8.1.13",
               "PAN-OS 8.1.12",
               "PAN-OS 8.1.11",
               "PAN-OS 8.1.10",
               "PAN-OS 8.1.9-h4",
               "PAN-OS 8.1.9-h3",
               "PAN-OS 8.1.9-h2",
               "PAN-OS 8.1.9-h1",
               "PAN-OS 8.1.9",
               "PAN-OS 8.1.8-h5",
               "PAN-OS 8.1.8-h4",
               "PAN-OS 8.1.8-h3",
               "PAN-OS 8.1.8-h2",
               "PAN-OS 8.1.8-h1",
               "PAN-OS 8.1.8",
               "PAN-OS 8.1.7",
               "PAN-OS 8.1.6-h2",
               "PAN-OS 8.1.6-h1",
               "PAN-OS 8.1.6",
               "PAN-OS 8.1.5",
               "PAN-OS 8.1.4",
               "PAN-OS 8.1.3",
               "PAN-OS 8.1.2",
               "PAN-OS 8.1.1",
               "PAN-OS 8.1.0",
               "PAN-OS 8.1",
            ],
            x_likelyAffectedList: [
               "PAN-OS 8.0.20",
               "PAN-OS 8.0.19-h1",
               "PAN-OS 8.0.19",
               "PAN-OS 8.0.18",
               "PAN-OS 8.0.17",
               "PAN-OS 8.0.16",
               "PAN-OS 8.0.15",
               "PAN-OS 8.0.14",
               "PAN-OS 8.0.13",
               "PAN-OS 8.0.12",
               "PAN-OS 8.0.11-h1",
               "PAN-OS 8.0.10",
               "PAN-OS 8.0.9",
               "PAN-OS 8.0.8",
               "PAN-OS 8.0.7",
               "PAN-OS 8.0.6-h3",
               "PAN-OS 8.0.6-h2",
               "PAN-OS 8.0.6-h1",
               "PAN-OS 8.0.6",
               "PAN-OS 8.0.5",
               "PAN-OS 8.0.4",
               "PAN-OS 8.0.3-h4",
               "PAN-OS 8.0.3-h3",
               "PAN-OS 8.0.3-h2",
               "PAN-OS 8.0.3-h1",
               "PAN-OS 8.0.3",
               "PAN-OS 8.0.2",
               "PAN-OS 8.0.1",
               "PAN-OS 8.0.0",
               "PAN-OS 8.0",
               "PAN-OS 7.1.26",
               "PAN-OS 7.1.25",
               "PAN-OS 7.1.24-h1",
               "PAN-OS 7.1.24",
               "PAN-OS 7.1.23",
               "PAN-OS 7.1.22",
               "PAN-OS 7.1.21",
               "PAN-OS 7.1.20",
               "PAN-OS 7.1.19",
               "PAN-OS 7.1.18",
               "PAN-OS 7.1.17",
               "PAN-OS 7.1.16",
               "PAN-OS 7.1.15",
               "PAN-OS 7.1.14",
               "PAN-OS 7.1.13",
               "PAN-OS 7.1.12",
               "PAN-OS 7.1.11",
               "PAN-OS 7.1.10",
               "PAN-OS 7.1.9-h4",
               "PAN-OS 7.1.9-h3",
               "PAN-OS 7.1.9-h2",
               "PAN-OS 7.1.9-h1",
               "PAN-OS 7.1.9",
               "PAN-OS 7.1.8",
               "PAN-OS 7.1.7",
               "PAN-OS 7.1.6",
               "PAN-OS 7.1.5",
               "PAN-OS 7.1.4-h2",
               "PAN-OS 7.1.4-h1",
               "PAN-OS 7.1.4",
               "PAN-OS 7.1.3",
               "PAN-OS 7.1.2",
               "PAN-OS 7.1.1",
               "PAN-OS 7.1.0",
               "PAN-OS 7.1",
            ],
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
      assignerShortName: "palo_alto",
      cveId: "CVE-2022-0022",
      datePublished: "2022-03-09T17:35:09.466087Z",
      dateReserved: "2021-12-28T00:00:00",
      dateUpdated: "2024-09-16T20:47:18.031Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2022-0022\",\"sourceIdentifier\":\"psirt@paloaltonetworks.com\",\"published\":\"2022-03-09T18:15:07.740\",\"lastModified\":\"2024-11-21T06:37:50.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7.\"},{\"lang\":\"es\",\"value\":\"Uso de un algoritmo criptográfico débil en el software PAN-OS de Palo Alto Networks en el que los hashes de las contraseñas de las cuentas de administrador y de usuario local no se crean con un nivel de esfuerzo computacional suficiente, lo que permite realizar ataques de descifrado de contraseñas en las cuentas en modo operativo normal (no FIPS-CC). Un atacante debe tener acceso a los hashes de las contraseñas de las cuentas para aprovechar esta debilidad y puede adquirir esos hashes si consigue acceder a la configuración del software PAN-OS. Las versiones corregidas del software PAN-OS utilizan un algoritmo criptográfico seguro para los hashes de las contraseñas de las cuentas. Este problema no afecta a los cortafuegos Prisma Access. Este problema afecta a: Las versiones de PAN-OS 8.1 anteriores a PAN-OS 8.1.21; todas las versiones de PAN-OS 9.0; las versiones de PAN-OS 9.1 anteriores a PAN-OS 9.1.11; las versiones de PAN-OS 10.0 anteriores a PAN-OS 10.0.7\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.5,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"psirt@paloaltonetworks.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-916\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-916\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.1.0\",\"versionEndExcluding\":\"8.1.21\",\"matchCriteriaId\":\"859B40E3-713E-4FB5-ACB1-0138D937E1B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndIncluding\":\"9.0.15\",\"matchCriteriaId\":\"991F1046-EED6-4D6E-B5C8-D60827E5ED5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.1.0\",\"versionEndExcluding\":\"9.1.11\",\"matchCriteriaId\":\"3725416F-6A77-40E2-91F3-3EDB9D6C9AC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.0.7\",\"matchCriteriaId\":\"3F183A33-114C-4A74-ACEF-51C176B3487F\"}]}]}],\"references\":[{\"url\":\"https://security.paloaltonetworks.com/CVE-2022-0022\",\"source\":\"psirt@paloaltonetworks.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://security.paloaltonetworks.com/CVE-2022-0022\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.