nvd-json-data-feeds/CVE-2020/CVE-2020-19xx/CVE-2020-1999.json

{
  "id": "CVE-2020-1999",
  "sourceIdentifier": "psirt@paloaltonetworks.com",
  "published": "2020-11-12T00:15:10.253",
  "lastModified": "2020-11-16T21:28:40.070",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad en el motor de detecci\u00f3n de amenazas basado en firmas de PAN-OS de Palo Alto Network que permite a un atacante comunicarse con dispositivos en la red de una manera que no se analiza en busca de amenazas mediante el env\u00edo de datos mediante paquetes TCP espec\u00edficamente dise\u00f1ados. Esta t\u00e9cnica evade la detecci\u00f3n de amenazas basada en firmas. Este problema afecta a: PAN-OS versiones 8.1 anteriores a 8.1.17; PAN-OS versiones 9.0 anteriores a 9.0.11; PAN-OS versiones 9.1 anteriores a 9.1.5; Todas las versiones de PAN-OS 7.1 y PAN-OS 8.0"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      },
      {
        "source": "psirt@paloaltonetworks.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    },
    {
      "source": "psirt@paloaltonetworks.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.1.0",
              "versionEndIncluding": "7.1.26",
              "matchCriteriaId": "9223062F-C3E8-4D86-88E4-70D775D1151F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndIncluding": "8.0.20",
              "matchCriteriaId": "2BEFBF38-AF84-4477-A6B9-5BDD51D54F4F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.1.0",
              "versionEndExcluding": "8.1.17",
              "matchCriteriaId": "6A42777F-938A-45FB-BCD3-9F1BEDF7DB02"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.0.0",
              "versionEndExcluding": "9.0.11",
              "matchCriteriaId": "5CE2A954-DB66-48F8-96D7-86846D1FE5D8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.1.0",
              "versionEndExcluding": "9.1.5",
              "matchCriteriaId": "872E6056-5BE6-4FE8-BE33-F98CF0DBC67C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2020-1999",
      "source": "psirt@paloaltonetworks.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}