title: PAN-OS: Panorama session disclosure during context switch into managed device
description: An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.
problem types: CWE-200 Information Exposure
affected:
{
product: PAN-OS
vendor: Palo Alto Networks
versions:
status: unaffected, version: 10.0.*
changes: [at: 8.1.17, status: unaffected], lessThan: 8.1.17, status: affected, version: 8.1, versionType: custom
changes: [at: 9.0.11, status: unaffected], lessThan: 9.0.11, status: affected, version: 9.0, versionType: custom
changes: [at: 9.1.5, status: unaffected], lessThan: 9.1.5, status: affected, version: 9.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
exploits: Palo Alto Networks is not aware of any malicious exploitation of this issue.
solutions: This issue is fixed in PAN-OS 8.1.17, PAN-OS 9.0.11, PAN-OS 9.1.5, and all later PAN-OS versions.
workarounds: This issue can be completely mitigated by enabling custom certificate authentication between Panorama and managed firewalls. See https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/set-up-panorama/set-up-authentication-using-custom-certificates.html