PT-2019-2805 · Palo Alto Networks · Pan-Os

Alycia N. Carey + 3 · Published 2019-07-15 · Updated 2020-08-11 · CVE-2019-1575

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PAN-OS versions 7.1.23 and earlier PAN-OS versions 8.0.18 and earlier PAN-OS versions 8.1.8-h4 and earlier PAN-OS versions 9.0.2 and earlier

Description The issue is related to information disclosure in PAN-OS, which may allow an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API, possibly escalating privileges granted to them. This is due to a lack of protection for service data.

Recommendations For PAN-OS versions 7.1.23 and earlier, update to a version later than 7.1.23 to resolve the issue. For PAN-OS versions 8.0.18 and earlier, update to a version later than 8.0.18 to resolve the issue. For PAN-OS versions 8.1.8-h4 and earlier, update to a version later than 8.1.8-h4 to resolve the issue. For PAN-OS versions 9.0.2 and earlier, update to a version later than 9.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the XML API until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-02760

CVE-2019-1575

Affected Products

Pan-Os

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-1575 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1575 · Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2019-1575 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02760 · Security Note
• http://securityfocus.com/bid/109176 · Note
• https://securityadvisories.paloaltonetworks.com/Home/Detail/157 · Note