Vulnerability · Published May 13, 2020 · Assigned by palo_alto
CVE-2020-1993PAN-OS: GlobalProtect Portal PHP session fixation vulnerability
Low 3.7
In plain English
A low-severity session fixation in PAN-OS from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 62.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.8.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | PAN-OS | 8.0.*7.1.*8.1 – before 8.1.149.0 – before 9.0.8 |
Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
- https://security.paloaltonetworks.com/CVE-2020-1993 x_refsource_MISC