Rapid7 Vulnerability & Exploit Database

Management web interface denial-of-service (DoS) through unauthenticated file upload

Back to Search

Management web interface denial-of-service (DoS) through unauthenticated file upload

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
09/14/2020
Created
09/15/2020
Added
09/14/2020
Modified
09/14/2020

Description

An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted after the request is finished. It is possible for an attacker to disrupt the availability of the management web interface by repeatedly uploading files until available disk space is exhausted.

Solution(s)

  • palo-alto-networks-pan-os-upgrade-10-0
  • palo-alto-networks-pan-os-upgrade-8-1
  • palo-alto-networks-pan-os-upgrade-9-0
  • palo-alto-networks-pan-os-upgrade-9-1

References

  • palo-alto-networks-pan-os-upgrade-10-0
  • palo-alto-networks-pan-os-upgrade-8-1
  • palo-alto-networks-pan-os-upgrade-9-0
  • palo-alto-networks-pan-os-upgrade-9-1

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;