Lucene search

K
cvelistPalo_altoCVELIST:CVE-2023-6795
HistoryDec 13, 2023 - 6:17 p.m.

CVE-2023-6795 PAN-OS: OS Command Injection Vulnerability in the Web Interface

2023-12-1318:17:43
CWE-78
palo_alto
www.cve.org
1
cve-2023-6795
palo alto networks
authenticated administrator
firewall
arbitrary code

5.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "changes": [
          {
            "at": "8.1.24-h1",
            "status": "unaffected"
          }
        ],
        "lessThan": "8.1.24-h1",
        "status": "affected",
        "version": "8.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.0.17",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.0.17",
        "status": "affected",
        "version": "9.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "9.1.12",
            "status": "unaffected"
          }
        ],
        "lessThan": "9.1.12",
        "status": "affected",
        "version": "9.1",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.0.9",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.0.9",
        "status": "affected",
        "version": "10.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.1.3",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.1.3",
        "status": "affected",
        "version": "10.1",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "10.2",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "11.0",
        "versionType": "custom"
      },
      {
        "lessThan": "All",
        "status": "unaffected",
        "version": "11.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Prisma Access",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Cloud NGFW",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  }
]

5.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

19.0%

Related for CVELIST:CVE-2023-6795