CWE Code: 200
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Information Exposure
Summary: information disclosure in pan-os 7.1.23 and earlier, pan-os 8.0.18 and earlier, pan-os 8.1.8-h4 and earlier, and pan-os 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the api key of the device and/or the username/password from the xml api (in pan-os) and possibly escalate privileges granted to them.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-07-16
Last Modified Date: 2019-07-19