CVEvulnerability

CVE-2017-7945

9.8 CRITICAL Published 2017-04-29 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-04-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-209

Description

The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests, aka PAN-SA-2017-0014 and PAN-72769.

Affected configurations

• paloaltonetworks pan-os (<= 6.1.15) • paloaltonetworks pan-os 7.0.0 • paloaltonetworks pan-os 7.0.1 • paloaltonetworks pan-os 7.0.2 • paloaltonetworks pan-os 7.0.3 • paloaltonetworks pan-os 7.0.4 • paloaltonetworks pan-os 7.0.5 • paloaltonetworks pan-os 7.0.6 • paloaltonetworks pan-os 7.0.7 • paloaltonetworks pan-os 7.0.8 • paloaltonetworks pan-os 7.0.9 • paloaltonetworks pan-os 7.0.10 • paloaltonetworks pan-os 7.0.11 • paloaltonetworks pan-os 7.0.12 • paloaltonetworks pan-os 7.0.13 • paloaltonetworks pan-os 7.0.14 • paloaltonetworks pan-os 7.1.0 • paloaltonetworks pan-os 7.1.1 • paloaltonetworks pan-os 7.1.2 • paloaltonetworks pan-os 7.1.3 • paloaltonetworks pan-os 7.1.4 • paloaltonetworks pan-os 7.1.5 • paloaltonetworks pan-os 7.1.6 • paloaltonetworks pan-os 7.1.7 • paloaltonetworks pan-os 7.1.8 • paloaltonetworks pan-os 8.0.0 • paloaltonetworks pan-os 8.0.1

Related

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References