CVE-2020-2013
PAN-OS: Panorama context switch session cookie disclosure
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama version, their PAN-OS session cookie is transmitted over cleartext to the firewall. An attacker with the ability to intercept this network traffic between the firewall and Panorama can access the administrator's account and further manipulate devices managed by Panorama. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1; All version of PAN-OS 8.0;
Una transmisión de texto claro de vulnerabilidad de información confidencial en el Panorama PAN-OS de Palo Alto Networks que revela una cookie de sesión PAN-OS autenticada por el administrador de PAN-OS. Cuando un administrador emite una solicitud de cambio de contexto a un firewall administrado con una versión de PAN-OS Panorama afectada, su cookie de sesión de PAN-OS se transmite por medio de texto claro al firewall. Un atacante con la capacidad de interceptar este tráfico de red entre el firewall y Panorama puede acceder a la cuenta del administrador y manipular aún más los dispositivos administrados por Panorama. Este problema afecta: PAN-OS 7.1 versiones anteriores a la versión 7.1.26; PAN-OS 8.1 versiones anteriores a la versión 8.1.13; PAN-OS 9.0 versiones anteriores a la versión 9.0.6; PAN-OS 9.1 versiones anteriores a la versión 9.1.1; Todas las versiones de PAN-OS 8.0;
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-12-04 CVE Reserved
- 2020-05-13 CVE Published
- 2023-03-07 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-319: Cleartext Transmission of Sensitive Information
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://security.paloaltonetworks.com/CVE-2020-2013 | 2020-05-18 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Paloaltonetworks Search vendor "Paloaltonetworks" | Pan-os Search vendor "Paloaltonetworks" for product "Pan-os" | >= 7.1.0 <= 7.1.26 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 7.1.0 <= 7.1.26" | - |
Affected
| ||||||
Paloaltonetworks Search vendor "Paloaltonetworks" | Pan-os Search vendor "Paloaltonetworks" for product "Pan-os" | >= 8.0.0 <= 8.0.20 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 8.0.0 <= 8.0.20" | - |
Affected
| ||||||
Paloaltonetworks Search vendor "Paloaltonetworks" | Pan-os Search vendor "Paloaltonetworks" for product "Pan-os" | >= 8.1.0 < 8.1.13 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 8.1.0 < 8.1.13" | - |
Affected
| ||||||
Paloaltonetworks Search vendor "Paloaltonetworks" | Pan-os Search vendor "Paloaltonetworks" for product "Pan-os" | >= 9.0.0 < 9.0.6 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.0.0 < 9.0.6" | - |
Affected
| ||||||
Paloaltonetworks Search vendor "Paloaltonetworks" | Pan-os Search vendor "Paloaltonetworks" for product "Pan-os" | >= 9.1.0 < 9.1.1 Search vendor "Paloaltonetworks" for product "Pan-os" and version " >= 9.1.0 < 9.1.1" | - |
Affected
|