Lucene search

K
cvelistPalo_altoCVELIST:CVE-2023-6795
HistoryDec 13, 2023 - 6:17 p.m.

CVE-2023-6795 PAN-OS: OS Command Injection Vulnerability in the Web Interface

2023-12-1318:17:43
CWE-78
palo_alto
www.cve.org
4
cve-2023-6795
palo alto networks
authenticated administrator
firewall
arbitrary code

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

18.8%

An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "changes": [
          {
            "at": "8.1.24-h1",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.1.24-h1",
        "status": "affected",
        "version": "8.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.0.17",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.0.17",
        "status": "affected",
        "version": "9.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.1.12",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.1.12",
        "status": "affected",
        "version": "9.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.0.9",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.0.9",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.1.3",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.1.3",
        "status": "affected",
        "version": "10.1",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "10.2",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "11.0",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "11.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Prisma Access",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Cloud NGFW",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  }
]

CVSS3

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

18.8%

Related for CVELIST:CVE-2023-6795