806 lines
39 KiB
JSON
806 lines
39 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2025-0126",
|
||
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "palo_alto",
|
||
"dateReserved": "2024-12-20T23:23:27.116Z",
|
||
"datePublished": "2025-04-11T01:57:12.662Z",
|
||
"dateUpdated": "2025-04-11T16:02:02.228Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "Cloud NGFW",
|
||
"vendor": "Palo Alto Networks",
|
||
"versions": [
|
||
{
|
||
"status": "unaffected",
|
||
"version": "All",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"cpes": [
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.2.2:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.2.1:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.1.3:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.1.2:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.1.1:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.0.5:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.0.4:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.0.3:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h9:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h8:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h12:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h11:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h10:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h9:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h8:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h7:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h6:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h5:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h4:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h3:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h2:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:h1:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h32:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h31:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h30:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h29:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h28:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h27:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h26:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h25:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h24:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h23:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h22:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h21:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h20:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h19:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h18:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h17:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h16:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h15:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h14:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h13:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h12:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h11:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h10:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h9:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h8:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h7:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h6:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h5:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h1:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h10:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h9:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h8:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h7:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h6:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h5:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h4:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h3:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h2:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:h1:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.14:-:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.13:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.12:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.11:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.10:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.9:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.8:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.7:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.6:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.5:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.4:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.3:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.2:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.1:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:paloaltonetworks:pan-os:10.1.0:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"product": "PAN-OS",
|
||
"vendor": "Palo Alto Networks",
|
||
"versions": [
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "11.2.3",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "11.2.3",
|
||
"status": "affected",
|
||
"version": "11.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "11.1.5",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "11.1.5",
|
||
"status": "affected",
|
||
"version": "11.1.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "11.0.6",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "11.0.6",
|
||
"status": "affected",
|
||
"version": "11.0.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "10.2.10-h6",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "10.2.11",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "10.2.4-h25",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "10.2.9-h13",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "10.2.10-h6",
|
||
"status": "affected",
|
||
"version": "10.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "10.1.14-h11",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "10.1.14-h11",
|
||
"status": "affected",
|
||
"version": "10.1.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"platforms": [
|
||
"PAN-OS"
|
||
],
|
||
"product": "Prisma Access",
|
||
"vendor": "Palo Alto Networks",
|
||
"versions": [
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "10.2.10-h16",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "10.2.4-h36",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "10.2.4-h36",
|
||
"status": "affected",
|
||
"version": "10.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "11.2.4-h5",
|
||
"status": "affected",
|
||
"version": "11.2.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"configurations": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p>This issue impacts only firewalls on which you configured a GlobalProtect portal to use SAML Authentication.</p><p>You can verify whether you configured GlobalProtect portal by checking for entries in your firewall web interface (Network → GlobalProtect → Portals).</p><p>If you do have GlobalProtect portals or gateways in your configuration, then you can verify whether you configured SAML Authentication on these portals by checking your firewall web interface (Network → GlobalProtect → Portals → (portal-config) → Authentication).</p>"
|
||
}
|
||
],
|
||
"value": "This issue impacts only firewalls on which you configured a GlobalProtect portal to use SAML Authentication.\n\nYou can verify whether you configured GlobalProtect portal by checking for entries in your firewall web interface (Network → GlobalProtect → Portals).\n\nIf you do have GlobalProtect portals or gateways in your configuration, then you can verify whether you configured SAML Authentication on these portals by checking your firewall web interface (Network → GlobalProtect → Portals → (portal-config) → Authentication)."
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "D'Angelo Gonzalez of CrowdStrike"
|
||
}
|
||
],
|
||
"datePublic": "2025-04-09T16:00:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker.<br><br>The SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched."
|
||
}
|
||
],
|
||
"value": "When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malicious link provided by the attacker.\n\nThe SAML login for the PAN-OS® management interface is not affected. Additionally, this issue does not affect Cloud NGFW and all Prisma® Access instances are proactively patched."
|
||
}
|
||
],
|
||
"exploits": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||
}
|
||
],
|
||
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-195",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-195 Principal Spoof"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"Automatable": "NO",
|
||
"Recovery": "USER",
|
||
"Safety": "NOT_DEFINED",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"attackVector": "NETWORK",
|
||
"baseScore": 8.3,
|
||
"baseSeverity": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"providerUrgency": "AMBER",
|
||
"subAvailabilityImpact": "NONE",
|
||
"subConfidentialityImpact": "HIGH",
|
||
"subIntegrityImpact": "NONE",
|
||
"userInteraction": "ACTIVE",
|
||
"valueDensity": "DIFFUSE",
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:H/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber",
|
||
"version": "4.0",
|
||
"vulnAvailabilityImpact": "HIGH",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "LOW",
|
||
"vulnerabilityResponseEffort": "MODERATE"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-384",
|
||
"description": "CWE-384 Session Fixation",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
|
||
"shortName": "palo_alto",
|
||
"dateUpdated": "2025-04-11T01:57:12.662Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://security.paloaltonetworks.com/CVE-2025-0126"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "eng",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr><td>PAN-OS 11.2<br></td><td>11.2.0 through 11.2.2<br></td><td>Upgrade to 11.2.3 or later</td></tr><tr><td>PAN-OS 11.1<br></td><td>11.1.0 through 11.1.4<br></td><td>Upgrade to 11.1.5 or later<br></td></tr><tr><td>PAN-OS 11.0</td><td>11.0.0 through 11.0.5</td><td>Upgrade to 11.0.6 or later</td></tr><tr><td>PAN-OS 10.2<br></td><td>10.2.10<br></td><td>Upgrade to 10.2.10-h6 or 10.2.11 or later<br></td></tr><tr><td> </td><td>10.2.5 through 10.2.9</td><td>Upgrade to 10.2.9-h13 or 10.2.11 or later</td></tr><tr><td> </td><td>10.2.0 through 10.2.4</td><td>Upgrade to 10.2.4-h25 or 10.2.11 or later</td></tr><tr><td>PAN-OS 10.1<br></td><td>10.1.0 through 10.1.14<br></td><td>Upgrade to 10.1.14-h11 or later<br></td></tr><tr><td>All other older <br>unsupported <br>PAN-OS versions</td><td> </td><td>Upgrade to a supported fixed version.</td></tr></tbody></table><br>PAN-OS 11.0 is EoL. We listed it in this section for completeness because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 in any of your firewalls, we strongly recommend that you upgrade from this EoL vulnerable version to a fixed version.<br><br>We proactively initiated an upgrade of Prisma Access on March 21, 2025, to cover all tenants.<br><p></p>"
|
||
}
|
||
],
|
||
"value": "Version\nMinor Version\nSuggested Solution\nPAN-OS 11.2\n11.2.0 through 11.2.2\nUpgrade to 11.2.3 or laterPAN-OS 11.1\n11.1.0 through 11.1.4\nUpgrade to 11.1.5 or later\nPAN-OS 11.011.0.0 through 11.0.5Upgrade to 11.0.6 or laterPAN-OS 10.2\n10.2.10\nUpgrade to 10.2.10-h6 or 10.2.11 or later\n 10.2.5 through 10.2.9Upgrade to 10.2.9-h13 or 10.2.11 or later 10.2.0 through 10.2.4Upgrade to 10.2.4-h25 or 10.2.11 or laterPAN-OS 10.1\n10.1.0 through 10.1.14\nUpgrade to 10.1.14-h11 or later\nAll other older \nunsupported \nPAN-OS versions Upgrade to a supported fixed version.\nPAN-OS 11.0 is EoL. We listed it in this section for completeness because we added a patch for PAN-OS 11.0 before it reached EoL. If you are running PAN-OS 11.0 in any of your firewalls, we strongly recommend that you upgrade from this EoL vulnerable version to a fixed version.\n\nWe proactively initiated an upgrade of Prisma Access on March 21, 2025, to cover all tenants."
|
||
}
|
||
],
|
||
"source": {
|
||
"defect": [
|
||
"PAN-253328"
|
||
],
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"timeline": [
|
||
{
|
||
"lang": "en",
|
||
"time": "2025-04-09T16:00:00.000Z",
|
||
"value": "Initial Publication"
|
||
}
|
||
],
|
||
"title": "PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login",
|
||
"workarounds": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p><span>This issue can be mitigated using a different form of authentication for the GlobalProtect portal (such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos). For more information about configuring authentication for the GlobalProtect portal see this technical </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab\"><span>documentation</span></a><span>.</span></p>"
|
||
}
|
||
],
|
||
"value": "This issue can be mitigated using a different form of authentication for the GlobalProtect portal (such as Client Certificate Authentication, RADIUS, TACACS+, LDAP, or Kerberos). For more information about configuring authentication for the GlobalProtect portal see this technical documentation https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab ."
|
||
}
|
||
],
|
||
"x_affectedList": [
|
||
"PAN-OS 11.2.2-h2",
|
||
"PAN-OS 11.2.2-h1",
|
||
"PAN-OS 11.2.1-h1",
|
||
"PAN-OS 11.2.1",
|
||
"PAN-OS 11.2.0-h1",
|
||
"PAN-OS 11.2.0",
|
||
"PAN-OS 11.1.4-h17",
|
||
"PAN-OS 11.1.4-h15",
|
||
"PAN-OS 11.1.4-h13",
|
||
"PAN-OS 11.1.4-h12",
|
||
"PAN-OS 11.1.4-h11",
|
||
"PAN-OS 11.1.4-h10",
|
||
"PAN-OS 11.1.4-h9",
|
||
"PAN-OS 11.1.4-h8",
|
||
"PAN-OS 11.1.4-h7",
|
||
"PAN-OS 11.1.4-h6",
|
||
"PAN-OS 11.1.4-h5",
|
||
"PAN-OS 11.1.4-h4",
|
||
"PAN-OS 11.1.4-h3",
|
||
"PAN-OS 11.1.4-h2",
|
||
"PAN-OS 11.1.4-h1",
|
||
"PAN-OS 11.1.4",
|
||
"PAN-OS 11.1.3-h13",
|
||
"PAN-OS 11.1.3-h12",
|
||
"PAN-OS 11.1.3-h11",
|
||
"PAN-OS 11.1.3-h10",
|
||
"PAN-OS 11.1.3-h9",
|
||
"PAN-OS 11.1.3-h8",
|
||
"PAN-OS 11.1.3-h7",
|
||
"PAN-OS 11.1.3-h6",
|
||
"PAN-OS 11.1.3-h5",
|
||
"PAN-OS 11.1.3-h4",
|
||
"PAN-OS 11.1.3-h3",
|
||
"PAN-OS 11.1.3-h2",
|
||
"PAN-OS 11.1.3-h1",
|
||
"PAN-OS 11.1.3",
|
||
"PAN-OS 11.1.2-h18",
|
||
"PAN-OS 11.1.2-h17",
|
||
"PAN-OS 11.1.2-h16",
|
||
"PAN-OS 11.1.2-h15",
|
||
"PAN-OS 11.1.2-h14",
|
||
"PAN-OS 11.1.2-h13",
|
||
"PAN-OS 11.1.2-h12",
|
||
"PAN-OS 11.1.2-h11",
|
||
"PAN-OS 11.1.2-h10",
|
||
"PAN-OS 11.1.2-h9",
|
||
"PAN-OS 11.1.2-h8",
|
||
"PAN-OS 11.1.2-h7",
|
||
"PAN-OS 11.1.2-h6",
|
||
"PAN-OS 11.1.2-h5",
|
||
"PAN-OS 11.1.2-h4",
|
||
"PAN-OS 11.1.2-h3",
|
||
"PAN-OS 11.1.2-h2",
|
||
"PAN-OS 11.1.2-h1",
|
||
"PAN-OS 11.1.2",
|
||
"PAN-OS 11.1.1-h2",
|
||
"PAN-OS 11.1.1-h1",
|
||
"PAN-OS 11.1.1",
|
||
"PAN-OS 11.1.0-h4",
|
||
"PAN-OS 11.1.0-h3",
|
||
"PAN-OS 11.1.0-h2",
|
||
"PAN-OS 11.1.0-h1",
|
||
"PAN-OS 11.1.0",
|
||
"PAN-OS 11.0.5-h2",
|
||
"PAN-OS 11.0.5-h1",
|
||
"PAN-OS 11.0.5",
|
||
"PAN-OS 11.0.4-h6",
|
||
"PAN-OS 11.0.4-h5",
|
||
"PAN-OS 11.0.4-h4",
|
||
"PAN-OS 11.0.4-h3",
|
||
"PAN-OS 11.0.4-h2",
|
||
"PAN-OS 11.0.4-h1",
|
||
"PAN-OS 11.0.4",
|
||
"PAN-OS 11.0.3-h13",
|
||
"PAN-OS 11.0.3-h12",
|
||
"PAN-OS 11.0.3-h11",
|
||
"PAN-OS 11.0.3-h10",
|
||
"PAN-OS 11.0.3-h9",
|
||
"PAN-OS 11.0.3-h8",
|
||
"PAN-OS 11.0.3-h7",
|
||
"PAN-OS 11.0.3-h6",
|
||
"PAN-OS 11.0.3-h5",
|
||
"PAN-OS 11.0.3-h4",
|
||
"PAN-OS 11.0.3-h3",
|
||
"PAN-OS 11.0.3-h2",
|
||
"PAN-OS 11.0.3-h1",
|
||
"PAN-OS 11.0.3",
|
||
"PAN-OS 11.0.2-h5",
|
||
"PAN-OS 11.0.2-h4",
|
||
"PAN-OS 11.0.2-h3",
|
||
"PAN-OS 11.0.2-h2",
|
||
"PAN-OS 11.0.2-h1",
|
||
"PAN-OS 11.0.2",
|
||
"PAN-OS 11.0.1-h5",
|
||
"PAN-OS 11.0.1-h4",
|
||
"PAN-OS 11.0.1-h3",
|
||
"PAN-OS 11.0.1-h2",
|
||
"PAN-OS 11.0.1-h1",
|
||
"PAN-OS 11.0.1",
|
||
"PAN-OS 11.0.0-h4",
|
||
"PAN-OS 11.0.0-h3",
|
||
"PAN-OS 11.0.0-h2",
|
||
"PAN-OS 11.0.0-h1",
|
||
"PAN-OS 11.0.0",
|
||
"PAN-OS 10.2.10-h14",
|
||
"PAN-OS 10.2.10-h13",
|
||
"PAN-OS 10.2.10-h12",
|
||
"PAN-OS 10.2.10-h11",
|
||
"PAN-OS 10.2.10-h10",
|
||
"PAN-OS 10.2.10-h9",
|
||
"PAN-OS 10.2.10-h8",
|
||
"PAN-OS 10.2.10-h7",
|
||
"PAN-OS 10.2.10-h6",
|
||
"PAN-OS 10.2.10-h5",
|
||
"PAN-OS 10.2.10-h4",
|
||
"PAN-OS 10.2.10-h3",
|
||
"PAN-OS 10.2.10-h2",
|
||
"PAN-OS 10.2.10-h1",
|
||
"PAN-OS 10.2.10",
|
||
"PAN-OS 10.2.9-h12",
|
||
"PAN-OS 10.2.9-h11",
|
||
"PAN-OS 10.2.9-h10",
|
||
"PAN-OS 10.2.9-h9",
|
||
"PAN-OS 10.2.9-h8",
|
||
"PAN-OS 10.2.9-h7",
|
||
"PAN-OS 10.2.9-h6",
|
||
"PAN-OS 10.2.9-h5",
|
||
"PAN-OS 10.2.9-h4",
|
||
"PAN-OS 10.2.9-h3",
|
||
"PAN-OS 10.2.9-h2",
|
||
"PAN-OS 10.2.9-h1",
|
||
"PAN-OS 10.2.9",
|
||
"PAN-OS 10.2.8-h21",
|
||
"PAN-OS 10.2.8-h20",
|
||
"PAN-OS 10.2.8-h19",
|
||
"PAN-OS 10.2.8-h18",
|
||
"PAN-OS 10.2.8-h17",
|
||
"PAN-OS 10.2.8-h16",
|
||
"PAN-OS 10.2.8-h15",
|
||
"PAN-OS 10.2.8-h14",
|
||
"PAN-OS 10.2.8-h13",
|
||
"PAN-OS 10.2.8-h12",
|
||
"PAN-OS 10.2.8-h11",
|
||
"PAN-OS 10.2.8-h10",
|
||
"PAN-OS 10.2.8-h9",
|
||
"PAN-OS 10.2.8-h8",
|
||
"PAN-OS 10.2.8-h7",
|
||
"PAN-OS 10.2.8-h6",
|
||
"PAN-OS 10.2.8-h5",
|
||
"PAN-OS 10.2.8-h4",
|
||
"PAN-OS 10.2.8-h3",
|
||
"PAN-OS 10.2.8-h2",
|
||
"PAN-OS 10.2.8-h1",
|
||
"PAN-OS 10.2.8",
|
||
"PAN-OS 10.2.7-h24",
|
||
"PAN-OS 10.2.7-h23",
|
||
"PAN-OS 10.2.7-h22",
|
||
"PAN-OS 10.2.7-h21",
|
||
"PAN-OS 10.2.7-h20",
|
||
"PAN-OS 10.2.7-h19",
|
||
"PAN-OS 10.2.7-h18",
|
||
"PAN-OS 10.2.7-h17",
|
||
"PAN-OS 10.2.7-h16",
|
||
"PAN-OS 10.2.7-h15",
|
||
"PAN-OS 10.2.7-h14",
|
||
"PAN-OS 10.2.7-h13",
|
||
"PAN-OS 10.2.7-h12",
|
||
"PAN-OS 10.2.7-h11",
|
||
"PAN-OS 10.2.7-h10",
|
||
"PAN-OS 10.2.7-h9",
|
||
"PAN-OS 10.2.7-h8",
|
||
"PAN-OS 10.2.7-h7",
|
||
"PAN-OS 10.2.7-h6",
|
||
"PAN-OS 10.2.7-h5",
|
||
"PAN-OS 10.2.7-h4",
|
||
"PAN-OS 10.2.7-h3",
|
||
"PAN-OS 10.2.7-h2",
|
||
"PAN-OS 10.2.7-h1",
|
||
"PAN-OS 10.2.7",
|
||
"PAN-OS 10.2.6-h6",
|
||
"PAN-OS 10.2.6-h5",
|
||
"PAN-OS 10.2.6-h4",
|
||
"PAN-OS 10.2.6-h3",
|
||
"PAN-OS 10.2.6-h2",
|
||
"PAN-OS 10.2.6-h1",
|
||
"PAN-OS 10.2.6",
|
||
"PAN-OS 10.2.5-h9",
|
||
"PAN-OS 10.2.5-h8",
|
||
"PAN-OS 10.2.5-h7",
|
||
"PAN-OS 10.2.5-h6",
|
||
"PAN-OS 10.2.5-h5",
|
||
"PAN-OS 10.2.5-h4",
|
||
"PAN-OS 10.2.5-h3",
|
||
"PAN-OS 10.2.5-h2",
|
||
"PAN-OS 10.2.5-h1",
|
||
"PAN-OS 10.2.5",
|
||
"PAN-OS 10.2.4-h32",
|
||
"PAN-OS 10.2.4-h31",
|
||
"PAN-OS 10.2.4-h30",
|
||
"PAN-OS 10.2.4-h29",
|
||
"PAN-OS 10.2.4-h28",
|
||
"PAN-OS 10.2.4-h27",
|
||
"PAN-OS 10.2.4-h26",
|
||
"PAN-OS 10.2.4-h25",
|
||
"PAN-OS 10.2.4-h24",
|
||
"PAN-OS 10.2.4-h23",
|
||
"PAN-OS 10.2.4-h22",
|
||
"PAN-OS 10.2.4-h21",
|
||
"PAN-OS 10.2.4-h20",
|
||
"PAN-OS 10.2.4-h19",
|
||
"PAN-OS 10.2.4-h18",
|
||
"PAN-OS 10.2.4-h17",
|
||
"PAN-OS 10.2.4-h16",
|
||
"PAN-OS 10.2.4-h15",
|
||
"PAN-OS 10.2.4-h14",
|
||
"PAN-OS 10.2.4-h13",
|
||
"PAN-OS 10.2.4-h12",
|
||
"PAN-OS 10.2.4-h11",
|
||
"PAN-OS 10.2.4-h10",
|
||
"PAN-OS 10.2.4-h9",
|
||
"PAN-OS 10.2.4-h8",
|
||
"PAN-OS 10.2.4-h7",
|
||
"PAN-OS 10.2.4-h6",
|
||
"PAN-OS 10.2.4-h5",
|
||
"PAN-OS 10.2.4-h4",
|
||
"PAN-OS 10.2.4-h3",
|
||
"PAN-OS 10.2.4-h2",
|
||
"PAN-OS 10.2.4-h1",
|
||
"PAN-OS 10.2.4",
|
||
"PAN-OS 10.2.3-h14",
|
||
"PAN-OS 10.2.3-h13",
|
||
"PAN-OS 10.2.3-h12",
|
||
"PAN-OS 10.2.3-h11",
|
||
"PAN-OS 10.2.3-h10",
|
||
"PAN-OS 10.2.3-h9",
|
||
"PAN-OS 10.2.3-h8",
|
||
"PAN-OS 10.2.3-h7",
|
||
"PAN-OS 10.2.3-h6",
|
||
"PAN-OS 10.2.3-h5",
|
||
"PAN-OS 10.2.3-h4",
|
||
"PAN-OS 10.2.3-h3",
|
||
"PAN-OS 10.2.3-h2",
|
||
"PAN-OS 10.2.3-h1",
|
||
"PAN-OS 10.2.3",
|
||
"PAN-OS 10.2.2-h6",
|
||
"PAN-OS 10.2.2-h5",
|
||
"PAN-OS 10.2.2-h4",
|
||
"PAN-OS 10.2.2-h3",
|
||
"PAN-OS 10.2.2-h2",
|
||
"PAN-OS 10.2.2-h1",
|
||
"PAN-OS 10.2.2",
|
||
"PAN-OS 10.2.1-h3",
|
||
"PAN-OS 10.2.1-h2",
|
||
"PAN-OS 10.2.1-h1",
|
||
"PAN-OS 10.2.1",
|
||
"PAN-OS 10.2.0-h4",
|
||
"PAN-OS 10.2.0-h3",
|
||
"PAN-OS 10.2.0-h2",
|
||
"PAN-OS 10.2.0-h1",
|
||
"PAN-OS 10.2.0",
|
||
"PAN-OS 10.1.14-h10",
|
||
"PAN-OS 10.1.14-h9",
|
||
"PAN-OS 10.1.14-h8",
|
||
"PAN-OS 10.1.14-h7",
|
||
"PAN-OS 10.1.14-h6",
|
||
"PAN-OS 10.1.14-h5",
|
||
"PAN-OS 10.1.14-h4",
|
||
"PAN-OS 10.1.14-h3",
|
||
"PAN-OS 10.1.14-h2",
|
||
"PAN-OS 10.1.14-h1",
|
||
"PAN-OS 10.1.14",
|
||
"PAN-OS 10.1.13-h5",
|
||
"PAN-OS 10.1.13-h4",
|
||
"PAN-OS 10.1.13-h3",
|
||
"PAN-OS 10.1.13-h2",
|
||
"PAN-OS 10.1.13-h1",
|
||
"PAN-OS 10.1.13",
|
||
"PAN-OS 10.1.12-h3",
|
||
"PAN-OS 10.1.12-h2",
|
||
"PAN-OS 10.1.12-h1",
|
||
"PAN-OS 10.1.12",
|
||
"PAN-OS 10.1.11-h10",
|
||
"PAN-OS 10.1.11-h9",
|
||
"PAN-OS 10.1.11-h8",
|
||
"PAN-OS 10.1.11-h7",
|
||
"PAN-OS 10.1.11-h6",
|
||
"PAN-OS 10.1.11-h5",
|
||
"PAN-OS 10.1.11-h4",
|
||
"PAN-OS 10.1.11-h3",
|
||
"PAN-OS 10.1.11-h2",
|
||
"PAN-OS 10.1.11-h1",
|
||
"PAN-OS 10.1.11",
|
||
"PAN-OS 10.1.10-h9",
|
||
"PAN-OS 10.1.10-h8",
|
||
"PAN-OS 10.1.10-h7",
|
||
"PAN-OS 10.1.10-h6",
|
||
"PAN-OS 10.1.10-h5",
|
||
"PAN-OS 10.1.10-h4",
|
||
"PAN-OS 10.1.10-h3",
|
||
"PAN-OS 10.1.10-h2",
|
||
"PAN-OS 10.1.10-h1",
|
||
"PAN-OS 10.1.10",
|
||
"PAN-OS 10.1.9-h14",
|
||
"PAN-OS 10.1.9-h13",
|
||
"PAN-OS 10.1.9-h12",
|
||
"PAN-OS 10.1.9-h11",
|
||
"PAN-OS 10.1.9-h10",
|
||
"PAN-OS 10.1.9-h9",
|
||
"PAN-OS 10.1.9-h8",
|
||
"PAN-OS 10.1.9-h7",
|
||
"PAN-OS 10.1.9-h6",
|
||
"PAN-OS 10.1.9-h5",
|
||
"PAN-OS 10.1.9-h4",
|
||
"PAN-OS 10.1.9-h3",
|
||
"PAN-OS 10.1.9-h2",
|
||
"PAN-OS 10.1.9-h1",
|
||
"PAN-OS 10.1.9",
|
||
"PAN-OS 10.1.8-h8",
|
||
"PAN-OS 10.1.8-h7",
|
||
"PAN-OS 10.1.8-h6",
|
||
"PAN-OS 10.1.8-h5",
|
||
"PAN-OS 10.1.8-h4",
|
||
"PAN-OS 10.1.8-h3",
|
||
"PAN-OS 10.1.8-h2",
|
||
"PAN-OS 10.1.8-h1",
|
||
"PAN-OS 10.1.8",
|
||
"PAN-OS 10.1.7-h1",
|
||
"PAN-OS 10.1.7",
|
||
"PAN-OS 10.1.6-h9",
|
||
"PAN-OS 10.1.6-h8",
|
||
"PAN-OS 10.1.6-h7",
|
||
"PAN-OS 10.1.6-h6",
|
||
"PAN-OS 10.1.6-h5",
|
||
"PAN-OS 10.1.6-h4",
|
||
"PAN-OS 10.1.6-h3",
|
||
"PAN-OS 10.1.6-h2",
|
||
"PAN-OS 10.1.6-h1",
|
||
"PAN-OS 10.1.6",
|
||
"PAN-OS 10.1.5-h4",
|
||
"PAN-OS 10.1.5-h3",
|
||
"PAN-OS 10.1.5-h2",
|
||
"PAN-OS 10.1.5-h1",
|
||
"PAN-OS 10.1.5",
|
||
"PAN-OS 10.1.4-h6",
|
||
"PAN-OS 10.1.4-h5",
|
||
"PAN-OS 10.1.4-h4",
|
||
"PAN-OS 10.1.4-h3",
|
||
"PAN-OS 10.1.4-h2",
|
||
"PAN-OS 10.1.4-h1",
|
||
"PAN-OS 10.1.4",
|
||
"PAN-OS 10.1.3-h4",
|
||
"PAN-OS 10.1.3-h3",
|
||
"PAN-OS 10.1.3-h2",
|
||
"PAN-OS 10.1.3-h1",
|
||
"PAN-OS 10.1.3",
|
||
"PAN-OS 10.1.2",
|
||
"PAN-OS 10.1.1",
|
||
"PAN-OS 10.1.0"
|
||
],
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.1.0-dev"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-04-11T15:33:31.861481Z",
|
||
"id": "CVE-2025-0126",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-04-11T16:02:02.228Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |