CVE-2022-0022
published 2022-03-09CVE-2022-0022: Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not…
PriorityP421medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.12%
2.3th percentile
Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| palo_alto_networks | pan-os | — | — |
| palo_alto_networks | pan-os | >= 10.0 < 10.0.7 | 10.0.7 |
| palo_alto_networks | pan-os | >= 8.1 < 8.1.21 | 8.1.21 |
| palo_alto_networks | pan-os | >= 9.1 < 9.1.11 | 9.1.11 |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
| paloaltonetworks | pan-os | >= 10.0.0 < 10.0.7 | 10.0.7 |
| paloaltonetworks | pan-os | >= 8.1.0 < 8.1.21 | 8.1.21 |
| paloaltonetworks | pan-os | 9.0.0 – 9.0.15 | — |
| paloaltonetworks | pan-os | >= 9.1.0 < 9.1.11 | 9.1.11 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
cisa6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware vRealize Operations contains multiple vulnerabilities
vendor_vmware·2022-08-09·CVSS 7.2
CVE-2022-31672 [HIGH] VMware vRealize Operations contains multiple vulnerabilities
VMSA-2022-0022: VMware vRealize Operations contains multiple vulnerabilities
VMware vRealize Operations contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
CVEs: CVE-2022-31672, CVE-2022-31673, CVE-2022-31674, CVE-2022-31675
Affected products: VMware Aria, VMware vRealize
CISA
Microsoft XML Core Services Information Disclosure Vulnerability
cisa·2022-05-24·CVSS 6.5
CVE-2017-0022 [MEDIUM] CWE-200 Microsoft XML Core Services Information Disclosure Vulnerability
Vulnerability: Microsoft XML Core Services Information Disclosure Vulnerability
Affected: Microsoft XML Core Services
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-0022
Remediation Due Date: 2022-06-14
Palo Alto
PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes
vendor_paloalto·2022-03-09·CVSS 4.4
CVE-2022-0022 [MEDIUM] CWE-916 PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes
PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes
Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode.
An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration.
Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes.
This issue does not impact Prisma Access firewalls.
Affected products: PAN-OS, Prisma Access
Solution: This issue is fi
GHSA
GHSA-4q2w-436r-jx75: Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are n
ghsa_unreviewed·2022-03-10
CVE-2022-0022 [MEDIUM] CWE-916 GHSA-4q2w-436r-jx75: Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are n
Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode.
An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration.
Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes.
This issue does not impact Prisma Access firewalls.
This issue impacts:
PAN-OS 8.1 versions earlier than PAN-OS 8.1.21;
All versions of PAN-OS 9.0;
PAN-OS 9.1 versions earlier than PAN-OS 9.1.11;
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-03-09
Published