PT-2019-3143 · Palo Alto Networks · Twistlock

William Wirahasbianto · Published 2019-08-23 · Updated 2020-08-24 · CVE-2019-1583

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Twistlock versions 19.07.358 and earlier

Description The issue is related to insufficient access control in the Palo Alto Networks Twistlock complex for cloud services and platform protection. It allows a remote attacker to escalate privileges. Active interaction with an affected component is required for the payload to execute on the victim. A Twistlock user with Operator capabilities can escalate privileges to those of another user.

Recommendations For versions 19.07.358 and earlier, consider restricting access to the Twistlock console to minimize the risk of exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-264

CWE-79

Related Identifiers

BDU:2019-03129

CVE-2019-1583

Affected Products

Twistlock

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-1583 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1583 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03129 · Security Note
• https://security.paloaltonetworks.com/CVE-2019-1583 · Note
• https://securityadvisories.paloaltonetworks.com · Note