CVE-2020-2022 — Sensitive Information Exposure in Palo Alto Networks Pan-os
CWE-200 — Sensitive Information ExposureCWE-269 — Improper Privilege ManagementCWE-284 — Improper Access ControlCWE-369 — Divide By ZeroCWE-125 — Out-of-bounds ReadCWE-787 — Out-of-bounds WriteCWE-22 — Path TraversalCWE-79 — Cross-site ScriptingCWE-502 — Deserialization of Untrusted DataCWE-918 — Server-Side Request ForgeryCWE-91 — XML Injection (aka Blind XPath Injection)CWE-78 — OS Command InjectionCWE-665 — Improper Initialization39 documents16 sources
Severity
7.5HIGHNVD
CISA9.8CISA8.8CISA7.8CISA7.3CISA5.5CISA5.4
EPSS
0.9%
top 24.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 12
Latest updateDec 24
Description
An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9
Affected Packages3 packages
🔴Vulnerability Details
7💥Exploits & PoCs
3📋Vendor Advisories
16Oracle
▶