CVE-2023-6791 - PAN-OS: Plaintext Disclosure of External System Integration Credentials

Back Back to CVE browser

MEDIUM

PAN-OS: Plaintext Disclosure of External System Integration Credentials

Published Dec 13, 2023

4.9

MEDIUM

CVSS 3.1

EPSS 0.62%

Description

A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credentials of stored external system integrations such as LDAP, SCP, RADIUS, TACACS+, and SNMP from the web interface.

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
unaffected
- Version
  10.0
  Status
  affected
  Constraints
  <10.0.12
- Version
  10.1
  Status
  affected
  Constraints
  <10.1.9
- Version
  10.2
  Status
  affected
  Constraints
  <10.2.4
- Version
  11.0
  Status
  affected
  Constraints
  <11.0.1
- Version
  8.1
  Status
  affected
  Constraints
  <8.1.24-h1
- Version
  9.0
  Status
  affected
  Constraints
  <9.0.17
- Version
  9.1
  Status
  affected
  Constraints
  <9.1.16
- Version
  11.1
  Status
  unaffected
  Constraints
  <All

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Pan-OS

unaffected

Version	Status	Constraints
10.0	affected	<10.0.12
10.1	affected	<10.1.9
10.2	affected	<10.2.4
11.0	affected	<11.0.1
8.1	affected	<8.1.24-h1
9.0	affected	<9.0.17
9.1	affected	<9.1.16
11.1	unaffected	<All

Remediation

Vendor solution

This issue is fixed in PAN-OS 8.1.24-h1, PAN-OS 9.0.17, PAN-OS 9.1.16, PAN-OS 10.0.12, PAN-OS 10.1.9, PAN-OS 10.2.4, PAN-OS 11.0.1, and all later PAN-OS versions.

You should issue new credentials for the impacted external integrations after you upgrade your PAN-OS software to a fixed version to prevent the misuse of previously exposed credentials.

Weaknesses (2)

CWE-522

Insufficiently Protected Credentials

CWE-701