title: PAN-OS: GlobalProtect Portal PHP session fixation vulnerability
description: The GlobalProtect Portal feature in PAN-OS does not set a new session identifier after a successful user login, which allows session fixation attacks, if an attacker is able to control a user's session ID. This issue affects: All PAN-OS 7.1 and 8.0 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.8.
problem types: CWE-384 Session Fixation
affected:
{
product: PAN-OS
vendor: Palo Alto Networks
versions:
status: affected, version: 8.0.*
status: affected, version: 7.1.*
changes: [at: 8.1.14, status: unaffected], lessThan: 8.1.14, status: affected, version: 8.1, versionType: custom
changes: [at: 9.0.8, status: unaffected], lessThan: 9.0.8, status: affected, version: 9.0, versionType: custom
lessThan: 9.2*, status: unaffected, version: 9.2.0, versionType: custom
lessThan: 9.1*, status: unaffected, version: 9.1.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
]
solutions: This issue is fixed in PAN-OS 8.1.14, PAN-OS 9.0.8, PAN-OS 9.1.0, PAN-OS 9.2.0, and all later PAN-OS versions.
PAN-OS 8.0 is now end-of-life as of October 31, 2019, and is no longer covered by our Product Security Assurance policies.
PAN-OS 7.1 is on extended support until June 30, 2020, and is only being considered for critical security vulnerability fixes.
workarounds: There are no known workarounds for this issue.