Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-2013 State: PUBLISHED Published: 2020-05-13T19:07:14.572738Z Last Updated: 2024-09-17T03:14:40.162Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-319 Description: A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama version, their PAN-OS session cookie is transmitted over cleartext to the firewall. An attacker with the ability to intercept this network t
S session cookie is transmitted over cleartext to the firewall. An attacker with the ability to intercept this network traffic between the firewall and Panorama can access the administrator's account and further manipulate devices managed by Panorama. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1; All version of PAN-OS 8.0; Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2013
CVE ID: CVE-2020-2014 State: PUBLISHED Published: 2020-05-13T19:07:14.616079Z Last Updated: 2024-09-16T19:30:56.709Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2014
CVE ID: CVE-2020-2015 State: PUBLISHED Published: 2020-05-13T19:07:14.649992Z Last Updated: 2024-09-16T16:13:05.308Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-120 Description: A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7; PAN-OS 9.1 versions earlier than 9.1.1; All versions of PAN-OS 8.0. Additional Analyst Notes: - CVE Program Cont
9.0.7; PAN-OS 9.1 versions earlier than 9.1.1; All versions of PAN-OS 8.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2015
CVE ID: CVE-2020-2016 State: PUBLISHED Published: 2020-05-13T19:07:14.700757Z Last Updated: 2024-09-16T23:31:31.207Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-377 Description: A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 ver
to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2016
CVE ID: CVE-2020-2017 State: PUBLISHED Published: 2020-05-13T19:07:14.735526Z Last Updated: 2024-09-16T22:57:10.284Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-79 Description: A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary JavaScript code in the administrator's browser and perform administrative actions. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier t
rform administrative actions. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2017
CVE ID: CVE-2020-2018 State: PUBLISHED Published: 2020-05-13T19:07:14.771651Z Last Updated: 2024-09-16T23:50:38.279Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-287 Description: An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to gain privileged access to managed firewalls. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue does not affect Panorama configured with custom certificates authentication for communication between Panorama and managed devices. T
ct Panorama configured with custom certificates authentication for communication between Panorama and managed devices. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.12; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2018
CVE ID: CVE-2020-2020 State: PUBLISHED Published: 2020-12-09T18:00:14.069887Z Last Updated: 2024-09-16T20:17:18.893Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: Cortex XDR Agent Problem Types: CWE-755 Description: An improper handling of exceptional conditions vulnerability in Cortex XDR Agent allows a local authenticated Windows user to create files in the software's internal program directory that prevents the Cortex XDR Agent from starting. The exceptional condition is persistent and prevents Cortex XDR Agent from starting when the software or machine is restarted. This issue impacts: Cortex XDR Agent 5.0 versions earlier
gent from starting when the software or machine is restarted. This issue impacts: Cortex XDR Agent 5.0 versions earlier than 5.0.10; Cortex XDR Agent 6.1 versions earlier than 6.1.7; Cortex XDR Agent 7.0 versions earlier than 7.0.3; Cortex XDR Agent 7.1 versions earlier than 7.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2020
CVE ID: CVE-2020-2021 State: PUBLISHED Published: 2020-06-29T15:10:11.350Z Last Updated: 2025-10-21T23:35:41.842Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-347 Description: When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versio
er must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientle
SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular
ity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted m
core of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.paloaltonetworks.com/CVE-2020-2021
CVE ID: CVE-2020-2022 State: PUBLISHED Published: 2020-11-12T00:05:21.095155Z Last Updated: 2024-09-16T17:08:08.587Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-200 Description: An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this is
ileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2022
CVE ID: CVE-2020-2023 State: PUBLISHED Published: 2020-06-10T17:30:12.051641Z Last Updated: 2024-09-17T01:15:36.499Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Kata Containers Products: Kata Containers Problem Types: CWE-250 Description: Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions. Additional Analyst Notes: - CVE Program Container: Refer
lier than 1.10.5; and Kata Containers 1.9 and earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kata-containers/runtime/pull/2487 - https://github.com/kata-containers/runtime/pull/2477 - https://github.com/kata-containers/runtime/issues/2488 - https://github.com/kata-containers/agent/issues/791 - https://github.com/kata-containers/agent/pull/792 - https://github.com/kata-containers/runtime/releases/tag/1.11.1 - https://github.com/kata-containers/runtime/releases/tag/1.10.5
CVE ID: CVE-2020-2024 State: PUBLISHED Published: 2020-05-19T21:05:19.715098Z Last Updated: 2024-09-17T01:01:22.908Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Kata Containers Products: Kata Containers Problem Types: CWE-59 Description: An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resulting in a host DoS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kata-containers/runtime/issues/2474 - https://github.com/kat
: - CVE Program Container: References: - https://github.com/kata-containers/runtime/issues/2474 - https://github.com/kata-containers/runtime/pull/2475
CVE ID: CVE-2020-2025 State: PUBLISHED Published: 2020-05-19T21:05:21.801319Z Last Updated: 2024-09-16T19:35:36.062Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Kata Containers Products: Kata Containers Problem Types: CWE-284 Description: Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM image file with all VMMs, this issue may also affect QEMU and Firecracker based guests. Additional Analyst Notes: - CVE Program Container: References: - https://github.
fect QEMU and Firecracker based guests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kata-containers/runtime/pull/2487
CVE ID: CVE-2020-2026 State: PUBLISHED Published: 2020-06-10T17:27:46.151024Z Last Updated: 2024-09-16T19:35:42.559Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Kata Containers Products: Kata Containers Problem Types: CWE-59 Description: A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earli
ners 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kata-containers/runtime/releases/tag/1.11.1 - https://github.com/kata-containers/runtime/releases/tag/1.10.5 - https://github.com/kata-containers/runtime/issues/2712 - https://github.com/kata-containers/runtime/pull/2713 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJAMOVB7DSOGX7J26QH5HZKU7GSSX2VU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JPBKAQBF3OR72N55GWM2TDYQP2OHK
/lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6JPBKAQBF3OR72N55GWM2TDYQP2OHK6H/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6W5MKF7HSAIL2AX2BX6RV4WWVGUIKVLS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWACJQSMY5BVDMVTF3FBN7HZSOSFOG3Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNJHSSPCKUGJDVXXIXK2JUWCRJDQX7CE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2P7FHA4AF6Y6PAVJBTTQPUEHXZQUOF3P/
CVE ID: CVE-2020-2027 State: PUBLISHED Published: 2020-06-10T17:28:15.853924Z Last Updated: 2024-09-17T03:17:38.535Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-121 Description: A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7. Additional Analyst Notes: - CVE Program Container: References
-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2027
CVE ID: CVE-2020-2028 State: PUBLISHED Published: 2020-06-10T17:28:28.840562Z Last Updated: 2024-09-16T18:18:19.426Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7. Additional Analyst Notes: - CVE Program Container: References: - htt
.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2028
CVE ID: CVE-2020-2029 State: PUBLISHED Published: 2020-06-10T17:28:40.767720Z Last Updated: 2024-09-16T16:52:57.682Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configuration. This issue affects: All versions of PAN-OS 8.0; PAN-OS 7.1 versions earlier than PAN-OS 7.1.26; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. Additional Analyst Notes
PAN-OS 7.1 versions earlier than PAN-OS 7.1.26; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2029
CVE ID: CVE-2020-2030 State: PUBLISHED Published: 2020-07-08T16:35:16.949620Z Last Updated: 2024-09-17T02:10:36.204Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; and all versions of PAN-OS 7.1 and PAN-OS 8.0. This issue does not impact PAN-OS 9.0, PAN-OS 9.1, or Prisma Access services. Additional Analyst Notes: - CVE Program Container: References: - https:
N-OS 9.0, PAN-OS 9.1, or Prisma Access services. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2030
CVE ID: CVE-2020-2031 State: PUBLISHED Published: 2020-07-08T16:35:17.389144Z Last Updated: 2024-09-16T17:58:42.448Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-191 Description: An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issue a command from the command line interface that causes the component to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 9.1 versions earlie
S services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. This issue does not impact PAN-OS 8.1, PAN-OS 9.0, or Prisma Access services. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2031
CVE ID: CVE-2020-2032 State: PUBLISHED Published: 2020-06-10T17:29:03.167538Z Last Updated: 2024-09-17T02:27:10.850Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-367 Description: A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with SYSTEM privileges. This issue can be exploited only while performing a GlobalProtect app upgrade. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 on Windows; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 on Windows. Add
GlobalProtect app 5.0.10 on Windows; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2032
CVE ID: CVE-2020-2033 State: PUBLISHED Published: 2020-06-10T17:29:41.793194Z Last Updated: 2024-09-17T03:22:58.911Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Palo Alto Networks Products: GlobalProtect App Problem Types: CWE-290, CWE-295 Description: When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manipulate ARP or to conduct ARP spoofing attacks. This allows the attacker to access the GlobalProtect Server as allowed by configured Security rules for
oofing attacks. This allows the attacker to access the GlobalProtect Server as allowed by configured Security rules for the 'pre-login' user. This access may be limited compared to the network access of regular users. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 when the prelogon feature is enabled; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 when the prelogon feature is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2033
CVE ID: CVE-2020-2034 State: PUBLISHED Published: 2020-07-08T16:35:17.820922Z Last Updated: 2024-09-16T19:46:13.523Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Palo Alto Networks Products: PAN-OS Problem Types: CWE-78 Description: An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than P
ure is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://security.paloaltonetworks.com/CVE-2020-2034