PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface (Palo Alto Networks Cloud NGFW)
En bref
- Source
- NVD
- EPSS
- EPSS 2.00 % · centile 81 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- palo_alto
- Statut NVD
- Analyzed
Rechercher sur…
Description
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access software.
Faiblesses (CWE)
- CWE-73 — External Control of File Name or Path
- CWE-610 — Référence contrôlée de l'extérieur vers une ressource d'une autre sphère
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Red | palo_alto |
| CVSS 4.0 | MEDIUM 5.9 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber | palo_alto |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Red | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-1508
- GCVE · GCVE-0-2025-0111
Avis du CERT-FR
- CERTFR-2025-AVI-0128 — Multiples vulnérabilités dans les produits Palo Alto Networks · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.1.0 < 10.1.14cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.2.0 < 10.2.7cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.2.10 < 10.2.12cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 11.0.0 < 11.1.6cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 11.2.0 < 11.2.4cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h13:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h15:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h14:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h16:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h18:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h19:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h3:*:*:*:*:*:*- +8 autres
Produits affectés
| Produit | Versions |
|---|---|
| Palo Alto Networks · Cloud NGFW | unaffected All |
| Palo Alto Networks · PAN-OS | affected 10.1.0 < 10.1.14-h9 ; affected 10.2.0 < 10.2.7-h24 ; affected 11.1.0 < 11.1.6-h1 ; affected 11.2.0 < 11.2.4-h4 |
| Palo Alto Networks · Prisma Access | unaffected All |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |