CVE-2019-1579

Katalog CVE

CVSS 8.1 · High KEV · sudah dieksploitasi Dipakai ransomware EPSS 46,2%

Kerentanan Use of Externally-Controlled Format String pada paloaltonetworks pan-os. Skor CVSS 3.1 8.1 (High) menurut NVD. Masuk katalog KEV CISA pada 10 Januari 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.

Rincian

Terbit di NVD

19 Juli 2019

Terakhir diubah

2 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

46,2% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Masuk KEV

10 Januari 2022

Tenggat CISA

10 Juli 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.paloaltonetworks.com/CVE-2019-1579 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1579 pemerintah AS
• http://www.securityfocus.com/bid/109310 broken link · advisory pihak ketiga · vdb entry
• https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-... exploit · advisory pihak ketiga
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010 broken link · advisory pihak ketiga