Information disclosure in Palo Alto PAN-OS

1) Information disclosure

EUVDB-ID: #VU35711

Risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-1575

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and possibly escalate privileges granted to them.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Palo Alto PAN-OS: 8.1.8

CPE2.3

• cpe:2.3:o:palo_alto_networks:pan-os:8.1.8:*:*:*:*:*:*:*

External links

https://www.securityfocus.com/bid/109176
https://security.paloaltonetworks.com/CVE-2019-1575

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.