CVE-2019-1575 — Sensitive Information Exposure in Paloaltonetworks Pan-os

CWE-200 — Sensitive Information Exposure5 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.7%
top 28.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Paloaltonetworks Pan-osPalo Alto Networks Pan-osPaloalto Pan-os
Timeline
PublishedJul 16
Latest updateMay 24

Description

Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and possibly escalate privileges granted to them.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDpaloaltonetworks/pan-os8.0.0 — 8.0.19+4
▶Palo Altopaloalto/pan-os
▶CVEListV5palo_alto/palo_alto_networks_pan-os4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-mxj5-9849-29f5: Information disclosure in PAN-OS 7↗2022-05-24
▶
CVEList
CVE-2019-1575: Information disclosure in PAN-OS 7↗2019-07-16
▶

📋Vendor Advisories

1
Palo Alto
Information Disclosure in PAN-OS Management API Usage↗2019-07-15
▶

💬Community

1
Bugzilla
CVE-2019-14532 sleuth: off-by-one overwrite due to underflow in tools/hashtools/hfind.cpp↗2019-09-13
▶
CVE-2019-1575 — Sensitive Information Exposure | cvebase