CVE-2020-1993CWE-384

PAN-OS: GlobalProtect Portal PHP session fixation vulnerability

Low · published May 13, 2020

CVSS v3.1
3.7
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.8.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.5th percentile
Weakness
CWE-384 · Session Fixation
Published
2020-05-13T19:07Z
EPSS history
Timeline
  • 13 MAY 19:07Z
    PAN-OS: GlobalProtect Portal PHP session fixation vulnerability
    cvelistv5