CVE-2020-1998CWE-285

PAN-OS: Improper SAML SSO authorization of shared local users

Medium · published May 13, 2020

CVSS v3.1
5.4
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource access for the user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; PAN-OS 9.1 versions earlier than 9.1.1; All versions of PAN-OS 8.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00892 · 59.0th percentile
Weakness
CWE-285 · Improper Authorization
Published
2020-05-13T19:07Z
EPSS history
Timeline
  • 13 MAY 19:07Z
    PAN-OS: Improper SAML SSO authorization of shared local users
    cvelistv5