CVE-2023-6794
Assigner: palo_alto
Published: 2023-12-13T18:16:39.175Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: PAN-OS
vendor: Palo Alto Networks
versions: changes: at: 8.1.26
status: unaffected
lessThan: 8.1.26
status: affected
version: 8.1
versionType: custom
changes: at: 9.0.17-h1
status: unaffected
lessThan: 9.0.17-h1
status: affected
version: 9.0
versionType: custom
changes: at: 9.1.14
status: unaffected
lessThan: 9.1.14
status: affected
version: 9.1
versionType: custom
lessThan: All
status: unaffected
version: 10.1
versionType: custom
lessThan: All
status: unaffected
version: 10.2
versionType: custom
lessThan: All
status: unaffected
version: 11.0
versionType: custom
lessThan: All
status: unaffected
version: 11.1
versionType: custom
defaultStatus: unaffected
product: Prisma Access
vendor: Palo Alto Networks
versions: status: unaffected
version: All
defaultStatus: unaffected
product: Cloud NGFW
vendor: Palo Alto Networks
versions: status: unaffected
version: All
datePublic: 2023-12-13T17:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
value: An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.
exploits: supportingMedia: base64: no
type: text/html
value: Palo Alto Networks is not aware of any malicious exploitation of this issue.
value: Palo Alto Networks is not aware of any malicious exploitation of this issue.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: This issue is fixed in PAN-OS 8.1.26, PAN-OS 9.0.17-h1, PAN-OS 9.1.14, and all later PAN-OS versions.
value: This issue is fixed in PAN-OS 8.1.26, PAN-OS 9.0.17-h1, PAN-OS 9.1.14, and all later PAN-OS versions.
source: discovery: INTERNAL
timeline: time: 2023-12-13T17:00:00.000Z
value: Initial publication
title: PAN-OS: File Upload Vulnerability in the Web Interface
workarounds: supportingMedia: base64: no
type: text/html
value: This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices.
value: This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices.
x_generator: engine: Vulnogram 0.1.0-dev