« Volver al listado

CVE-2015-4162

Estado: ModificadaMedia (4)—

XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Paloaltonetworks — Pan-os

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-4162",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-06-02T14:59:21.940",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/74941",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2015-4162",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/74941",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2015-4162",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XML external entity (XXE) vulnerability in the management interface in PAN-OS before 5.0.16, 6.x before 6.0.8, and 6.1.x before 6.1.4 allows remote authenticated administrators to obtain sensitive information via crafted XML data."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de entidad externa XML (XXE) en la interfaz de gestión en PAN-OS anterior a 5.0.16, 6.x anterior a 6.0.8, y 6.1.x anterior a 6.1.4 permite a administradores remotos autenticados obtener información sensible a través de datos XML manipulados."
    }
  ],
  "lastModified": "2026-06-17T00:26:50.673",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24F3F457-E394-4E69-867D-2BFC14A45C9F",
              "versionEndIncluding": "5.0.15"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F4DB103-A11A-4C38-A167-F0FCB8F6AA70"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A86F16D-61CA-4681-91CB-F397AC090F87"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "583BC735-6DF1-40CE-880B-F91F233EAE17"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C43C313-A379-46C2-96B9-F510AA3E40AA"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D55C68C0-1396-4640-8EBB-39E91347E037"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7793347E-7D25-4B5E-B958-03DD0E7D94C4"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72841E93-FE05-4A92-B75E-300446ECCFC6"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74D17E3A-BD59-42F6-940B-A82138C40317"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35E2F87A-AAF7-4DAC-836A-6EE632CCD121"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "505662DA-CE0B-433F-99EE-E6E4B86E8C5E"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10729E31-4313-4735-B38E-92C453904AAD"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:6.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60C621F1-28AC-49DB-BB40-66303CE51376"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/611.html\">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>",
  "sourceIdentifier": "cve@mitre.org"
}