CVE-2019-1579

8.1HIGH

Key Information:

Vendor
Palo Alto Networks
Status
Palo Alto Networks Globalprotect Portal/gateway Interface
Vendor
CVE Published:
19 July 2019

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 95%🦅 CISA Reported

Summary

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Palo Alto Networks GlobalProtect Portal/Gateway Interface PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier, and PAN-OS 8.1.2 and earlier releases

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-1579
Created by securifera

CVE-2019-1579
Created by Elsfa7-110

References

http://www.securityfocus.com/bid/109310
vdb-entryx_refsource_BID
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-201...
x_refsource_CONFIRM
https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1...
x_refsource_MISC

EPSS Score

95% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 🦅

    CISA Reported

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.