CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2022-0024 – PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit
https://notcve.org/view.php?id=CVE-2022-0024
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5. Se presenta una vulnerabilidad en el software PAN-OS de Palo Alto Networks que permite a un administrador autenticado de PAN-OS basado en la red cargar una configuración creada específicamente que interrumpe los procesos del sistema y potencialmente ejecuta código arbitrario con privilegios de root cuando la configuración es comprometida tanto en los firewalls de hardware como en los virtuales. Este problema no afecta a los dispositivos de Panorama ni a clientes de Prisma Access. • https://security.paloaltonetworks.com/CVE-2022-0024 • CWE-138: Improper Neutralization of Special Elements •
CVSS: 5.9EPSS: 0%CPEs: 5EXPL: 0CVE-2022-0023 – PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy
https://notcve.org/view.php?id=CVE-2022-0023
An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle (MITM) to send specifically crafted traffic to the firewall that causes the service to restart unexpectedly. Repeated attempts to send this request result in denial-of-service to all PAN-OS services by restarting the device in maintenance mode. This issue does not impact Panorama appliances and Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.22; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5. This issue does not impact PAN-OS 10.2. • https://security.paloaltonetworks.com/CVE-2022-0023 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 4.6EPSS: 0%CPEs: 4EXPL: 0CVE-2022-0022 – PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes
https://notcve.org/view.php?id=CVE-2022-0022
Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not created with a sufficient level of computational effort, which allows for password cracking attacks on accounts in normal (non-FIPS-CC) operational mode. An attacker must have access to the account password hashes to take advantage of this weakness and can acquire those hashes if they are able to gain access to the PAN-OS software configuration. Fixed versions of PAN-OS software use a secure cryptographic algorithm for account password hashes. This issue does not impact Prisma Access firewalls. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; All versions of PAN-OS 9.0; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7. • https://security.paloaltonetworks.com/CVE-2022-0022 • CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2022-0011 – PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering
https://notcve.org/view.php?id=CVE-2022-0011
PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. • https://security.paloaltonetworks.com/CVE-2022-0011 • CWE-436: Interpretation Conflict •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-3063 – PAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway Interfaces
https://notcve.org/view.php?id=CVE-2021-3063
An improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h4; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8-h4; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers are not impacted by this issue. Se presenta una vulnerabilidad de administración inapropiada de condiciones excepcionales en las interfaces de portal y puerta de enlace de Palo Alto Networks GlobalProtect que permite a un atacante no autenticado basado en la red enviar tráfico específicamente diseñado a una interfaz de GlobalProtect que cause que el servicio deje de responder. • https://security.paloaltonetworks.com/CVE-2021-3063 • CWE-755: Improper Handling of Exceptional Conditions •