CVE-2022-0030 — Authentication Bypass by Spoofing in Palo Alto Networks Pan-os

CWE-290 — Authentication Bypass by Spoofing5 documents5 sources
Severity
8.1HIGHNVD
EPSS
0.2%
top 58.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Cloud Ngfw+2 more
Timeline
PublishedOct 12
Latest updateDec 8

Description

An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages5 packages

▶NVDpaloaltonetworks/pan-os8.1.0 — 8.1.24
▶CVEListV5palo_alto_networks/pan-os8.1 — 8.1.24
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-6jrf-v33r-v8h2: An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8↗2022-10-12
▶
CVEList
PAN-OS: Authentication Bypass in Web Interface↗2022-10-12
▶

📋Vendor Advisories

2
VMware
VMware ESXi and vCenter Server updates address multiple security vulnerabilities (CVE-2022-31696, CVE-2022-31697, CVE-2022-31698, CVE-2022-31699)↗2022-12-08
▶
Palo Alto
PAN-OS: Authentication Bypass in Web Interface↗2022-10-12
▶
CVE-2022-0030 — Authentication Bypass by Spoofing | cvebase