Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-2013

A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie. When an administrator issues a context switch request into a managed firewall with an affected PAN-OS Panorama version, their PAN-OS session cookie is transmitted over cleartext to the firewall. An attacker with the ability to intercept this network traffic between the firewall and Panorama can access the administrator's account and further manipulate devices managed by Panorama. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1; All version of PAN-OS 8.0;

Published

2020-05-13T19:15:14.017

Last Modified

2024-11-21T05:24:27.013

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.3 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.6

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-319
  • Type: Primary
    CWE-319
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System paloaltonetworks pan-os ≤ 7.1.26 Yes
Operating System paloaltonetworks pan-os ≤ 8.0.20 Yes
Operating System paloaltonetworks pan-os < 8.1.13 Yes
Operating System paloaltonetworks pan-os < 9.0.6 Yes
Operating System paloaltonetworks pan-os < 9.1.1 Yes
References