{"containers": {"cna": {"affected": [{"product": "PAN-OS", "vendor": "Palo Alto Networks", "versions": [{"status": "affected", "version": "9.0.*"}, {"changes": [{"at": "8.1.21", "status": "unaffected"}], "lessThan": "8.1.21", "status": "affected", "version": "8.1", "versionType": "custom"}, {"changes": [{"at": "9.1.12", "status": "unaffected"}], "lessThan": "9.1.12", "status": "affected", "version": "9.1", "versionType": "custom"}, {"changes": [{"at": "10.0.8", "status": "unaffected"}], "lessThan": "10.0.8", "status": "affected", "version": "10.0", "versionType": "custom"}, {"changes": [{"at": "10.1.3", "status": "unaffected"}], "lessThan": "10.1.3", "status": "affected", "version": "10.1", "versionType": "custom"}]}, {"product": "Prisma Access", "vendor": "Palo Alto Networks", "versions": [{"status": "unaffected", "version": "3.0 Preferred, Innovation"}, {"status": "affected", "version": "2.2 Preferred"}, {"status": "affected", "version": "2.1 Preferred, Innovation"}]}], "configurations": [{"lang": "en", "value": "This issue is applicable only when you configure exceptions to URL filtering either by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile as per https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/block-and-allow-lists.html."}], "credits": [{"lang": "en", "value": "Palo Alto Networks thanks Chris Johnston of PricewaterhouseCoopers for discovering and reporting this issue."}], "datePublic": "2022-02-09T00:00:00", "descriptions": [{"lang": "en", "value": "PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL."}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "description": "CWE-436 Interpretation Conflict", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-02-10T18:10:15", "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://security.paloaltonetworks.com/CVE-2022-0011"}], "solutions": [{"lang": "en", "value": "PAN-OS 8.1.21, PAN-OS 9.1.12, PAN-OS 10.0.8, PAN-OS 10.1.3, Prisma Access 3.0 Preferred, and Prisma Access 3.0 Innovation all include a customer configurable option to automatically append a forward slash at the end of the hostname pattern for entries without an ending token in a custom URL category list or in an external dynamic list (EDL).\n\nPrisma Access customers should refer to \u201cSTEP 7\u201d in the following Prisma Access 3.0 documentation to enable this feature:\n\nhttps://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-prisma-access-infrastructure/prisma-access-service-infrastructure/enable-the-service-infrastructure.html\n\nFor other PAN-OS appliances, this option is enabled by running these CLI commands:\n debug device-server append-end-token on\n commit force\n\nNote: This option is disabled by default on PAN-OS 8.1, PAN-OS 9.1, PAN-OS 10.0, and PAN-OS 10.1. This option will be enabled by default starting with the next major version of PAN-OS. This option is not available on PAN-OS 9.0. Customers with PAN-OS 9.0 are advised to apply workarounds or upgrade to PAN-OS 9.1 or a later version.\n\nAdditionally, customers must evaluate their custom URL category list or their external dynamic list (EDL) and any firewall policy rules that depend on them to determine whether this option provides the desired policy rule enforcement.\n\nExample 1: If the firewall policy rule is intended to allow only 'www.example.com' and not to allow access to any other site, such as www.example.com.webiste.test, then use the \"debug device-server append-end-token on\" CLI command.\n\nExample 2: If the firewall policy rule is set to block access to 'www.example.co' and block access to sites such as www.example.com, www.example.co.az, then keep the default setting (\"debug device-server append-end-token off\" CLI command). You should always use the most appropriate token if you need to match multiple hostnames in a policy rule."}], "source": {"defect": ["PAN-174443"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2022-02-09T00:00:00", "value": "initial publication"}], "title": "PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering", "workarounds": [{"lang": "en", "value": "Add a forward slash (/) at the end of the hostname pattern for all entries in the custom URL category list or the external dynamic list (EDL).\n\nFor example:\n example.com/ will not match example.com.website.test"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@paloaltonetworks.com", "DATE_PUBLIC": "2022-02-09T17:00:00.000Z", "ID": "CVE-2022-0011", "STATE": "PUBLIC", "TITLE": "PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PAN-OS", "version": {"version_data": [{"version_affected": "<", "version_name": "8.1", "version_value": "8.1.21"}, {"version_affected": "<", "version_name": "9.1", "version_value": "9.1.12"}, {"version_affected": "<", "version_name": "10.0", "version_value": "10.0.8"}, {"version_affected": "!>=", "version_name": "8.1", "version_value": "8.1.21"}, {"version_affected": "!>=", "version_name": "9.1", "version_value": "9.1.12"}, {"version_affected": "!>=", "version_name": "10.0", "version_value": "10.0.8"}, {"version_affected": "=", "version_name": "9.0", "version_value": "9.0.*"}, {"version_affected": "<", "version_name": "10.1", "version_value": "10.1.3"}, {"version_affected": "!>=", "version_name": "10.1", "version_value": "10.1.3"}]}}, {"product_name": "Prisma Access", "version": {"version_data": [{"version_affected": "!", "version_name": "3.0", "version_value": "Preferred, Innovation"}, {"version_affected": "=", "version_name": "2.2", "version_value": "Preferred"}, {"version_affected": "=", "version_name": "2.1", "version_value": "Preferred, Innovation"}]}}]}, "vendor_name": "Palo Alto Networks"}]}}, "configuration": [{"lang": "en", "value": "This issue is applicable only when you configure exceptions to URL filtering either by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile as per https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/block-and-allow-lists.html."}], "credit": [{"lang": "eng", "value": "Palo Alto Networks thanks Chris Johnston of PricewaterhouseCoopers for discovering and reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL."}]}, "exploit": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-436 Interpretation Conflict"}]}]}, "references": {"reference_data": [{"name": "https://security.paloaltonetworks.com/CVE-2022-0011", "refsource": "MISC", "url": "https://security.paloaltonetworks.com/CVE-2022-0011"}]}, "solution": [{"lang": "en", "value": "PAN-OS 8.1.21, PAN-OS 9.1.12, PAN-OS 10.0.8, PAN-OS 10.1.3, Prisma Access 3.0 Preferred, and Prisma Access 3.0 Innovation all include a customer configurable option to automatically append a forward slash at the end of the hostname pattern for entries without an ending token in a custom URL category list or in an external dynamic list (EDL).\n\nPrisma Access customers should refer to \u201cSTEP 7\u201d in the following Prisma Access 3.0 documentation to enable this feature:\n\nhttps://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-prisma-access-infrastructure/prisma-access-service-infrastructure/enable-the-service-infrastructure.html\n\nFor other PAN-OS appliances, this option is enabled by running these CLI commands:\n debug device-server append-end-token on\n commit force\n\nNote: This option is disabled by default on PAN-OS 8.1, PAN-OS 9.1, PAN-OS 10.0, and PAN-OS 10.1. This option will be enabled by default starting with the next major version of PAN-OS. This option is not available on PAN-OS 9.0. Customers with PAN-OS 9.0 are advised to apply workarounds or upgrade to PAN-OS 9.1 or a later version.\n\nAdditionally, customers must evaluate their custom URL category list or their external dynamic list (EDL) and any firewall policy rules that depend on them to determine whether this option provides the desired policy rule enforcement.\n\nExample 1: If the firewall policy rule is intended to allow only 'www.example.com' and not to allow access to any other site, such as www.example.com.webiste.test, then use the \"debug device-server append-end-token on\" CLI command.\n\nExample 2: If the firewall policy rule is set to block access to 'www.example.co' and block access to sites such as www.example.com, www.example.co.az, then keep the default setting (\"debug device-server append-end-token off\" CLI command). You should always use the most appropriate token if you need to match multiple hostnames in a policy rule."}], "source": {"defect": ["PAN-174443"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2022-02-09T00:00:00", "value": "initial publication"}], "work_around": [{"lang": "en", "value": "Add a forward slash (/) at the end of the hostname pattern for all entries in the custom URL category list or the external dynamic list (EDL).\n\nFor example:\n example.com/ will not match example.com.website.test"}], "x_advisoryEoL": false, "x_affectedList": ["Prisma Access 2.2", "Prisma Access 2.1", "PAN-OS 10.1.2", "PAN-OS 10.1.1", "PAN-OS 10.1.0", "PAN-OS 10.1", "PAN-OS 10.0.7", "PAN-OS 10.0.6", "PAN-OS 10.0.5", "PAN-OS 10.0.4", "PAN-OS 10.0.3", "PAN-OS 10.0.2", "PAN-OS 10.0.1", "PAN-OS 10.0.0", "PAN-OS 10.0", "PAN-OS 9.1.11-h3", "PAN-OS 9.1.11-h2", "PAN-OS 9.1.11-h1", "PAN-OS 9.1.11", "PAN-OS 9.1.10", "PAN-OS 9.1.9", "PAN-OS 9.1.8", "PAN-OS 9.1.7", "PAN-OS 9.1.6", "PAN-OS 9.1.5", "PAN-OS 9.1.4", "PAN-OS 9.1.3-h1", "PAN-OS 9.1.3", "PAN-OS 9.1.2-h1", "PAN-OS 9.1.2", "PAN-OS 9.1.1", "PAN-OS 9.1.0-h3", "PAN-OS 9.1.0-h2", "PAN-OS 9.1.0-h1", "PAN-OS 9.1.0", "PAN-OS 9.1", "PAN-OS 9.0.15", "PAN-OS 9.0.14-h4", "PAN-OS 9.0.14-h3", "PAN-OS 9.0.14-h2", "PAN-OS 9.0.14-h1", "PAN-OS 9.0.14", "PAN-OS 9.0.13", "PAN-OS 9.0.12", "PAN-OS 9.0.11", "PAN-OS 9.0.10", "PAN-OS 9.0.9-h1", "PAN-OS 9.0.9", "PAN-OS 9.0.8", "PAN-OS 9.0.7", "PAN-OS 9.0.6", "PAN-OS 9.0.5", "PAN-OS 9.0.4", "PAN-OS 9.0.3-h3", "PAN-OS 9.0.3-h2", "PAN-OS 9.0.3-h1", "PAN-OS 9.0.3", "PAN-OS 9.0.2-h4", "PAN-OS 9.0.2-h3", "PAN-OS 9.0.2-h2", "PAN-OS 9.0.2-h1", "PAN-OS 9.0.2", "PAN-OS 9.0.1", "PAN-OS 9.0.0", "PAN-OS 9.0", "PAN-OS 8.1.20-h1", "PAN-OS 8.1.20", "PAN-OS 8.1.19", "PAN-OS 8.1.18", "PAN-OS 8.1.17", "PAN-OS 8.1.16", "PAN-OS 8.1.15-h3", "PAN-OS 8.1.15-h2", "PAN-OS 8.1.15-h1", "PAN-OS 8.1.15", "PAN-OS 8.1.14-h2", "PAN-OS 8.1.14-h1", "PAN-OS 8.1.14", "PAN-OS 8.1.13", "PAN-OS 8.1.12", "PAN-OS 8.1.11", "PAN-OS 8.1.10", "PAN-OS 8.1.9-h4", "PAN-OS 8.1.9-h3", "PAN-OS 8.1.9-h2", "PAN-OS 8.1.9-h1", "PAN-OS 8.1.9", "PAN-OS 8.1.8-h5", "PAN-OS 8.1.8-h4", "PAN-OS 8.1.8-h3", "PAN-OS 8.1.8-h2", "PAN-OS 8.1.8-h1", "PAN-OS 8.1.8", "PAN-OS 8.1.7", "PAN-OS 8.1.6-h2", "PAN-OS 8.1.6-h1", "PAN-OS 8.1.6", "PAN-OS 8.1.5", "PAN-OS 8.1.4", "PAN-OS 8.1.3", "PAN-OS 8.1.2", "PAN-OS 8.1.1", "PAN-OS 8.1.0", "PAN-OS 8.1"], "x_likelyAffectedList": ["PAN-OS 8.0.20", "PAN-OS 8.0.19-h1", "PAN-OS 8.0.19", "PAN-OS 8.0.18", "PAN-OS 8.0.17", "PAN-OS 8.0.16", "PAN-OS 8.0.15", "PAN-OS 8.0.14", "PAN-OS 8.0.13", "PAN-OS 8.0.12", "PAN-OS 8.0.11-h1", "PAN-OS 8.0.10", "PAN-OS 8.0.9", "PAN-OS 8.0.8", "PAN-OS 8.0.7", "PAN-OS 8.0.6-h3", "PAN-OS 8.0.6-h2", "PAN-OS 8.0.6-h1", "PAN-OS 8.0.6", "PAN-OS 8.0.5", "PAN-OS 8.0.4", "PAN-OS 8.0.3-h4", "PAN-OS 8.0.3-h3", "PAN-OS 8.0.3-h2", "PAN-OS 8.0.3-h1", "PAN-OS 8.0.3", "PAN-OS 8.0.2", "PAN-OS 8.0.1", "PAN-OS 8.0.0", "PAN-OS 8.0", "PAN-OS 7.1.26", "PAN-OS 7.1.25", "PAN-OS 7.1.24-h1", "PAN-OS 7.1.24", "PAN-OS 7.1.23", "PAN-OS 7.1.22", "PAN-OS 7.1.21", "PAN-OS 7.1.20", "PAN-OS 7.1.19", "PAN-OS 7.1.18", "PAN-OS 7.1.17", "PAN-OS 7.1.16", "PAN-OS 7.1.15", "PAN-OS 7.1.14", "PAN-OS 7.1.13", "PAN-OS 7.1.12", "PAN-OS 7.1.11", "PAN-OS 7.1.10", "PAN-OS 7.1.9-h4", "PAN-OS 7.1.9-h3", "PAN-OS 7.1.9-h2", "PAN-OS 7.1.9-h1", "PAN-OS 7.1.9", "PAN-OS 7.1.8", "PAN-OS 7.1.7", "PAN-OS 7.1.6", "PAN-OS 7.1.5", "PAN-OS 7.1.4-h2", "PAN-OS 7.1.4-h1", "PAN-OS 7.1.4", "PAN-OS 7.1.3", "PAN-OS 7.1.2", "PAN-OS 7.1.1", "PAN-OS 7.1.0", "PAN-OS 7.1"]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:18:41.438Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://security.paloaltonetworks.com/CVE-2022-0011"}]}]}, "cveMetadata": {"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "assignerShortName": "palo_alto", "cveId": "CVE-2022-0011", "datePublished": "2022-02-10T18:10:15.524395Z", "dateReserved": "2021-12-28T00:00:00", "dateUpdated": "2024-09-16T23:51:26.574Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "859B40E3-713E-4FB5-ACB1-0138D937E1B6", "versionEndExcluding": "8.1.21", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "991F1046-EED6-4D6E-B5C8-D60827E5ED5B", "versionEndIncluding": "9.0.15", "versionStartIncluding": "9.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "0140F71E-9AAC-4B20-BBFA-B8849549508F", "versionEndExcluding": "9.1.12", "versionStartIncluding": "9.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "C408A950-281A-49DC-9376-F1D943280371", "versionEndExcluding": "10.0.8", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*", "matchCriteriaId": "40AFDDF3-0AB4-4A18-93E9-01EE5BDE9D2E", "versionEndExcluding": "10.1.3", "versionStartIncluding": "10.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:prisma_access:2.1:*:*:*:innovation:*:*:*", "matchCriteriaId": "926E678E-AD52-472F-89E3-69C82F67414D", "vulnerable": true}, {"criteria": "cpe:2.3:a:paloaltonetworks:prisma_access:2.1:*:*:*:preferred:*:*:*", "matchCriteriaId": "B277183B-3FC8-472D-83AD-CAB5F4783B7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:paloaltonetworks:prisma_access:2.2:*:*:*:preferred:*:*:*", "matchCriteriaId": "A8BAAE8C-D606-4C43-A048-1D2BE35D75F9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL."}, {"lang": "es", "value": "El software PAN-OS ofrece opciones para excluir sitios web espec\u00edficos de la aplicaci\u00f3n de la categor\u00eda de URL y esos sitios web son bloqueados o se permiten (dependiendo de sus reglas) independientemente de su categor\u00eda de URL asociada. Esto es hecho al crear una lista de categor\u00edas de URL personalizada o usando una lista din\u00e1mica externa (EDL) en un perfil de filtrado de URL. Cuando las entradas de estas listas presentan un patr\u00f3n de nombre de host que no termina con una barra diagonal (/) o un patr\u00f3n de nombre de host que termina con un asterisco (*), cualquier URL que comience con el patr\u00f3n especificado es considerado una coincidencia. Las entradas con un signo de interrogaci\u00f3n (^) al final de un patr\u00f3n de nombre de host coinciden con cualquier dominio de nivel superior. Esto puede permitir o bloquear inadvertidamente m\u00e1s URLs de las previstas y permitir m\u00e1s URLs de las previstas representa un riesgo de seguridad. Por ejemplo: example.com coincidir\u00e1 con example.com.website.test example.com.* coincidir\u00e1 con example.com.website.test example.com.^ coincidir\u00e1 con example.com.test Debe tener especial cuidado cuando use estas entradas en las reglas de pol\u00edtica que permiten el tr\u00e1fico. Siempre que sea posible, use la lista exacta de nombres de host que terminan con una barra diagonal (/) en lugar de usar comodines. PAN-OS versiones 10.1 anteriores a PAN-OS 10.1.3; PAN-OS versiones 10.0 anteriores a PAN-OS 10.0.8; PAN-OS versiones 9.1 anteriores a PAN-OS 9.1.12; todas PAN-OS versiones 9.0; PAN-OS versiones 8.1 anteriores a PAN-OS 8.1.21, y las versiones de Prisma Access 2.2 y 2.1 no permiten a clientes cambiar este comportamiento sin cambiar la lista de categor\u00edas de URL o EDL"}], "id": "CVE-2022-0011", "lastModified": "2024-11-21T06:37:48.660", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-10T18:15:08.437", "references": [{"source": "psirt@paloaltonetworks.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2022-0011"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://security.paloaltonetworks.com/CVE-2022-0011"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-436"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}