PT-2018-18925 · Palo Alto Networks · Pan-Os

Xinming Nie · Published 2018-06-29 · Updated 2020-02-17 · CVE-2018-9242

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions PAN-OS versions 6.1.20 and earlier PAN-OS versions 7.1.16 and earlier PAN-OS versions 8.0.9 and earlier

Description A vulnerability in the Management web interface may allow an attacker to delete files in the system via specific request parameters. This issue can potentially be exploited for local privilege escalation. The Management web interface does not properly validate specific request parameters. Successful exploitation of this issue requires the attacker to be authenticated.

Recommendations For PAN-OS versions 6.1.20 and earlier, update to a version later than 6.1.20 to resolve the issue. For PAN-OS versions 7.1.16 and earlier, update to a version later than 7.1.16 to resolve the issue. For PAN-OS versions 8.0.9 and earlier, update to a version later than 8.0.9 to resolve the issue. As a temporary workaround, consider restricting access to the Management web interface to minimize the risk of exploitation.

Fix

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-9242

Affected Products

Pan-Os

References · 5

• https://osv.dev/vulnerability/CVE-2018-9242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-9242 · Security Note
• http://securityfocus.com/bid/104676 · Note
• http://securitytracker.com/id/1041242 · Note
• https://security.paloaltonetworks.com/CVE-2018-9242 · Note