CVE-2020-2022CWE-200

PAN-OS: Panorama session disclosure during context switch into managed device

High · published November 12, 2020

CVSS v3.1
7.5
EPSS
1%
Percentile
68.6
In the wild
Unconfirmed
What it is

An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01225 · 68.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2020-11-12T00:05Z
EPSS history
Timeline
  • 12 NOV 00:05Z
    PAN-OS: Panorama session disclosure during context switch into managed device
    cvelistv5