PT-2019-3143 · Palo Alto Networks · Twistlock

William Wirahasbianto · Publicado 2019-08-23 · Atualizado 2020-08-24 · CVE-2019-1583

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Twistlock versions 19.07.358 and earlier

Description The issue is related to insufficient access control in the Palo Alto Networks Twistlock complex for cloud services and platform protection. It allows a remote attacker to escalate privileges. Active interaction with an affected component is required for the payload to execute on the victim. A Twistlock user with Operator capabilities can escalate privileges to those of another user.

Recommendations For versions 19.07.358 and earlier, consider restricting access to the Twistlock console to minimize the risk of exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-264

CWE-79

Identificadores relacionados

BDU:2019-03129

CVE-2019-1583

Produtos afetados

Twistlock

Referências · 5

• https://security.paloaltonetworks.com/CVE-2019-1583 · Nota
• https://securityadvisories.paloaltonetworks.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1583 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-1583 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-03129 · Nota de Segurança