CVE-2013-5663
Status: ModifiedMedium (4.3)—
The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identification of HTTP traffic as SIP traffic, aka Ref ID 47195.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
- Base score: 4.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.82%
- Percentile among all scored CVEs: 86
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-264
References
- http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx
- http://pastie.org/pastes/5568186/text
- http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update/
- https://security.paloaltonetworks.com/CVE-2013-5663
- http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx
- http://pastie.org/pastes/5568186/text
- http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update/
- https://security.paloaltonetworks.com/CVE-2013-5663
Raw JSON (NVD)
Show
{
"id": "CVE-2013-5663",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2013-08-31T17:55:03.650",
"references": [
{
"url": "http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx",
"source": "cve@mitre.org"
},
{
"url": "http://pastie.org/pastes/5568186/text",
"tags": [
"Exploit"
],
"source": "cve@mitre.org"
},
{
"url": "http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update/",
"source": "cve@mitre.org"
},
{
"url": "https://security.paloaltonetworks.com/CVE-2013-5663",
"source": "cve@mitre.org"
},
{
"url": "http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://pastie.org/pastes/5568186/text",
"tags": [
"Exploit"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.paloaltonetworks.com/CVE-2013-5663",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identification of HTTP traffic as SIP traffic, aka Ref ID 47195."
},
{
"lang": "es",
"value": "La característica App-ID cache en Palo Alto Networks PAN-OS anterior a 4.0.14, 4.1.x anterior a 4.1.11 y 5.0.x anterior a 5.0.2, permite a atacantes remotos evitar las políticas de seguridad establecidas a través de una petición que provoca un cacheo no válido, como se demostró mediante la identificación incorrecta del tráfico HTTP como tráfico SIP. Aka Ref ID 47195."
}
],
"lastModified": "2026-06-16T23:59:12.827",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "07C92F2C-BDC6-4B92-B8E4-C7750DDFAF52",
"versionEndIncluding": "4.0.8"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9547FFD1-8161-45C4-BEC9-0BC30FA46A92"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0384B38B-C69B-4DAB-9276-7B10AAAD588F"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB324D9A-7A8A-4AD6-89F7-F4F9EA2441DE"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "540806F7-4C35-43CD-8AC0-7D9FAC42FEF5"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "818D028C-627D-49A4-ACD6-44821BA5106A"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0C789DFD-189D-4CF3-A3BF-B2B854BEFE9A"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30831F67-692C-497A-8F33-59F57AE2D513"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81D87787-B186-46A2-8A11-0AEDFBD17D7A"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6E1861E9-228B-4A82-B885-987CEFAA7974"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C3773D9-21A6-4102-879B-C902D7F33F1F"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17BB4059-3A6E-451F-BE4F-BF14C8186F9F"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "81D4D653-1BBD-4228-AE3F-62C9F75DE8AB"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27837759-0371-4A94-9E54-66155FCCB072"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EEB6E3EA-ED06-4934-9349-DF0AB9B8EBB5"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5F76CD5-65D6-486C-96E1-999BF4141A38"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54019AC0-BB5E-4AD0-A06E-526BBEED83B1"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CC2A5DE-9C55-4CAE-B673-818CE29221ED"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.8-h3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33FAA6DA-4686-4C3A-A5F4-05A2FFFA479D"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E63C15B7-B83A-4ED1-99A7-71619B247645"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:4.1.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DF92DA6-CE52-40A5-A79A-CA9D9CFEF39B"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9560C45E-6F66-47BA-B4B5-8DFBB72E80A0"
},
{
"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:5.0.0-h1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD60F39D-3941-4049-90AD-102A6351291B"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}