Lucene search

K
cvelistPalo_altoCVELIST:CVE-2023-6792
HistoryDec 13, 2023 - 6:16 p.m.

CVE-2023-6792 PAN-OS: OS Command Injection Vulnerability in the XML API

2023-12-1318:16:18
CWE-88
palo_alto
www.cve.org
4
pan-os
command injection
vulnerability
xml api
palo alto networks
authenticated user
firewall
arbitrary code

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

AI Score

7

Confidence

High

EPSS

0.001

Percentile

18.8%

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "changes": [
          {
            "at": "8.1.24",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.1.24",
        "status": "affected",
        "version": "8.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.0.17",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.0.17",
        "status": "affected",
        "version": "9.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.1.15",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.1.15",
        "status": "affected",
        "version": "9.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.0.12",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.0.12",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.1.6",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.1.6",
        "status": "affected",
        "version": "10.1",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "10.2",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "11.0",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "11.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Prisma Access",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Cloud NGFW",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  }
]

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

AI Score

7

Confidence

High

EPSS

0.001

Percentile

18.8%

Related for CVELIST:CVE-2023-6792