« Volver al listado

CVE-2023-6792

Estado: ModificadaMedia (6.3)—

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Paloaltonetworks — Pan-os

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-6792",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-6792",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-08T14:25:49.110797Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@paloaltonetworks.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "Palo Alto Networks",
          "product": "PAN-OS",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "8.1.24",
                  "status": "unaffected"
                }
              ],
              "version": "8.1",
              "lessThan": "8.1.24",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "9.0.17",
                  "status": "unaffected"
                }
              ],
              "version": "9.0",
              "lessThan": "9.0.17",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "9.1.15",
                  "status": "unaffected"
                }
              ],
              "version": "9.1",
              "lessThan": "9.1.15",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "10.0.12",
                  "status": "unaffected"
                }
              ],
              "version": "10.0",
              "lessThan": "10.0.12",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "10.1.6",
                  "status": "unaffected"
                }
              ],
              "version": "10.1",
              "lessThan": "10.1.6",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.2",
              "lessThan": "All",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "11.0",
              "lessThan": "All",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "11.1",
              "lessThan": "All",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "Prisma Access",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "Cloud NGFW",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-12-13T19:15:09.640",
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2023-6792",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2023-6792",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@paloaltonetworks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección de comandos del sistema operativo en la API XML del software PAN-OS de Palo Alto Networks permite a un usuario de API autenticado interrumpir los procesos del sistema y potencialmente ejecutar código arbitrario con privilegios limitados en el firewall."
    }
  ],
  "lastModified": "2026-06-17T06:51:26.277",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7D77695-CFDE-4BAE-8C8B-E389CC5C7A3F",
              "versionEndExcluding": "8.1.24",
              "versionStartIncluding": "8.1.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89A55C5F-8E01-42C4-BE93-D683900C07BE",
              "versionEndExcluding": "9.0.17",
              "versionStartIncluding": "9.0.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88CE0E44-13FF-4FD0-94D2-0C0823A7A70E",
              "versionEndExcluding": "9.1.15",
              "versionStartIncluding": "9.1.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71F1F86A-8158-4BE8-B509-5F50421DA829",
              "versionEndExcluding": "10.0.12",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6EB81D3-ADC7-4114-8FFB-C15780239391",
              "versionEndExcluding": "10.1.6",
              "versionStartIncluding": "10.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}