CVE-2020-2022

PAN-OS: Panorama session disclosure during context switch into managed device

En bref

Sévérité: HIGH 7.5
EPSS: EPSS 1.23 % · centile 69 (2026-10-27)
État: PUBLISHED
Publiée: 2020-11-12
Mise à jour: 2024-09-16
Attribuée par: palo_alto
Statut NVD: Modified

Description

An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	palo_alto
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · psirt@paloaltonetworks.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

Références européennes

ENISA EUVD · EUVD-2020-22050
GCVE · GCVE-0-2020-2022

Avis du CERT-FR

CERTFR-2020-AVI-730 — Multiples vulnérabilités dans Palo Alto PAN-OS · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 8.1.0 < 8.1.17
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.11
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* ≥ 9.1.0 < 9.1.5

Produits affectés

Produit	Versions
Palo Alto Networks · PAN-OS	unaffected 10.0.* ; affected 8.1 < 8.1.17 ; affected 9.0 < 9.0.11 ; affected 9.1 < 9.1.5

Références

https://security.paloaltonetworks.com/CVE-2020-2022

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD