Actively exploited · Published Jul 19, 2019 · Assigned by palo_alto
CVE-2019-1579
High 8.1 Exploited Ransomware
In plain English
A high-severity security flaw in Palo Alto Networks GlobalProtect Portal/Gateway Interface. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 44.2% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 10, 2022.
Official description
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Palo Alto Networks GlobalProtect Portal/Gateway Interface | PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier, and PAN-OS 8.1.2 and earlier releases |
Weakness: CWE-134 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 109310 vdb-entry, x_refsource_BID
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 x_refsource_CONFIRM
- https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/ x_refsource_MISC
- https://security.paloaltonetworks.com/CVE-2019-1579 x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579 government-resource