« Volver al listado

CVE-2019-1583

Estado: ModificadaAlta (8)—

La vulnerabilidad de escalada de privilegios en la consola Twistlock de Palo Alto Networks 19.07.358 y anteriores permite que un usuario de Twistlock con capacidades de Operador escale privilegios a los de otro usuario. Se requiere una interacción activa con un componente afectado para que la carga útil se ejecute en la víctima.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Paloaltonetworks — Twistlock

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-1583",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Palo Alto Networks Twistlock",
          "versions": [
            {
              "status": "affected",
              "version": "Twistlock console 19.07.358 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-23T18:15:11.627",
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2019-1583",
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2019-1583",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistlock user with Operator capabilities to escalate privileges to that of another user. Active interaction with an affected component is required for the payload to execute on the victim."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de escalada de privilegios en la consola Twistlock de Palo Alto Networks 19.07.358 y anteriores permite que un usuario de Twistlock con capacidades de Operador escale privilegios a los de otro usuario. Se requiere una interacción activa con un componente afectado para que la carga útil se ejecute en la víctima."
    }
  ],
  "lastModified": "2026-06-17T02:28:47.487",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:twistlock:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C26D920B-039D-47C8-A7EA-96FB2766864E",
              "versionEndIncluding": "19.07.357"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}