CVE-2020-1998 — Improper Authorization in Palo Alto Networks Pan-os

CWE-285 — Improper AuthorizationCWE-863 — Incorrect Authorization4 documents4 sources
Severity
8.8HIGHNVD
CNA5.4
EPSS
0.2%
top 55.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Pan-os
Timeline
PublishedMay 13
Latest updateMay 24

Description

An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource access for the user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1; …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDpaloaltonetworks/pan-os7.1.0 — 7.1.26+4
▶CVEListV5palo_alto_networks/pan-os8.1 — 8.1.13+4
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-mhxp-v7wq-3qqc: An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions o↗2022-05-24
▶
CVEList
PAN-OS: Improper SAML SSO authorization of shared local users↗2020-05-13
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: Improper SAML SSO authorization of shared local users↗2020-05-13
▶
CVE-2020-1998 — Improper Authorization in Palo | cvebase