Lucene search

K
paloaltoPalo Alto Networks Product Security Incident Response TeamPA-CVE-2023-6794
HistoryDec 13, 2023 - 5:00 p.m.

PAN-OS: File Upload Vulnerability in the Web Interface

2023-12-1317:00:00
Palo Alto Networks Product Security Incident Response Team
securityadvisories.paloaltonetworks.com
9
pan-os
file upload
vulnerability
web interface
administrator
system processes
arbitrary code
best practices
securing
administrative access

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.001

Percentile

20.0%

An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

Work around:
This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the impact of this issue by following the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices.

Affected configurations

Vulners
Node
softwarepan-osRange<8.1.26
OR
softwarepan-osRange<9.0.17-h1
OR
softwarepan-osRange<9.1.14
VendorProductVersionCPE
softwarepan-os*cpe:2.3:a:software:pan-os:*:*:*:*:*:*:*:*

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.001

Percentile

20.0%