PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload (Palo Alto Networks PAN-OS)
At a glance
- Source
- NVD
- EPSS
- EPSS 46.38 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- palo_alto
- NVD status
- Modified
Description
An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
Weaknesses (CWE)
- CWE-400 — Uncontrolled Resource Consumption
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | palo_alto |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2020-22065
- GCVE · GCVE-0-2020-2039
CERT-FR advisories
- CERTFR-2020-AVI-566 — Multiples vulnérabilités dans Palo Alto Networks PAN-OS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.16cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.10cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 9.1.0 < 9.1.4cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.0.1
Affected products
| Product | Versions |
|---|---|
| Palo Alto Networks · PAN-OS | affected 9.1 < 9.1.4 ; affected 8.1 < 8.1.16 ; affected 9.0 < 9.0.10 ; affected 10.0 < 10.0.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |