2 lines
4.9 KiB
JSON
2 lines
4.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Trust Protection Foundation","vendor":"Palo Alto Networks","versions":[{"changes":[{"at":"25.3.3","status":"unaffected"}],"lessThan":"25.3.3","status":"affected","version":"25.3.0","versionType":"custom"},{"changes":[{"at":"25.1.8","status":"unaffected"}],"lessThan":"25.1.8","status":"affected","version":"25.1.0","versionType":"custom"},{"changes":[{"at":"24.3.6","status":"unaffected"}],"lessThan":"24.3.6","status":"affected","version":"24.3.0","versionType":"custom"},{"changes":[{"at":"24.1.13","status":"unaffected"}],"lessThan":"24.1.13","status":"affected","version":"24.1.0","versionType":"custom"}]}],"source":"psirt@paloaltonetworks.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*","matchCriteriaId":"52DC45A9-9B20-4C9C-B080-95454CBF843B","versionEndExcluding":"24.1.13","versionStartIncluding":"24.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*","matchCriteriaId":"7EEE94C3-ADA5-4F01-A670-F902B48FEF65","versionEndExcluding":"24.3.6","versionStartIncluding":"24.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*","matchCriteriaId":"134B1209-C811-42B3-9F9A-D73A039B5E7C","versionEndExcluding":"25.1.8","versionStartIncluding":"25.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:paloaltonetworks:trust_protection_foundation:*:*:*:*:*:*:*:*","matchCriteriaId":"AD9D632C-8323-4099-8C50-6023335414D1","versionEndExcluding":"25.3.3","versionStartIncluding":"25.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings."},{"lang":"es","value":"Una vulnerabilidad de revelación de información en Trust Protection Foundation permite a un atacante autenticado obtener información sensible del almacén del servidor. La explotación exitosa de este problema permite al atacante suplantar a cualquier usuario dentro del entorno y modificar arbitrariamente la configuración."}],"id":"CVE-2026-0240","lastModified":"2026-10-26T14:10:00.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":5.8,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":4.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"UNREPORTED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"psirt@paloaltonetworks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0240","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-15T03:56:11.417596Z","version":"2.0.3"}}]},"published":"2026-05-13T19:16:57.767","references":[{"source":"psirt@paloaltonetworks.com","tags":["Vendor Advisory"],"url":"https://security.paloaltonetworks.com/CVE-2026-0240"}],"sourceIdentifier":"psirt@paloaltonetworks.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-497"}],"source":"psirt@paloaltonetworks.com","type":"Secondary"}]}
|