PAN-OS: System proxy passwords may be logged in clear text while viewing system state
Published Nov 12, 2020
3.3
LOWCVSS 3.1
EPSS 0.34%
Description
An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2.
Affected products
-
- Version 8.1StatusaffectedConstraints<8.1.17
- Version 9.0StatusaffectedConstraints<9.0.11
- Version 9.1StatusaffectedConstraints<9.1.2
- Version 10.0.*StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Palo Alto Networks | Pan-OS | n/a |
|
- ≥ 8.1.0 · < 8.1.17
- ≥ 9.0.0 · < 9.0.11
- ≥ 9.1.0 · < 9.1.2
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
This issue is fixed in PAN-OS 8.1.17, PAN-OS 9.0.11, PAN-OS 9.1.2, and all later PAN-OS versions.
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22074 Advisory
- https://security.paloaltonetworks.com/CVE-2020-2048 x_refsource_MISCVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-22074 | Advisory | |
| https://security.paloaltonetworks.com/CVE-2020-2048 | x_refsource_MISCVendor Advisory |
Change history (0)
No recorded changes yet.