6.5

CVE-2022-0011: palo alto networks pan-os Interpretation Conflict

CVSS: 6.5v3.1MediumModified
Published 10-02-2022Last modified 16-09-2024
Open JSON

Vulnerability summary

CVE-2022-0011 is a medium (CVSS 6.5) Interpretation Conflict vulnerability in palo alto networks pan-os. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.66%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 10-02-2022
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

0.66%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

0.00 pp

From 0.66% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Palo alto networks2 products
  • pan-osEOL≥ 9.0.0, < 9.1.0 | ≥ 8.1, < 8.1.21 | ≥ 9.1, < 9.1.12 | ≥ 10.0, < 10.0.8 | ≥ 10.1, < 10.1.3
  • prisma access2.2 Preferred | 2.1 Preferred, Innovation
Paloaltonetworks2 products
  • pan-os≥ 8.1.0, < 8.1.21 | ≥ 9.0.0, ≤ 9.0.15 | ≥ 9.1.0, < 9.1.12 | ≥ 10.0.0, < 10.0.8 | ≥ 10.1.0, < 10.1.3
  • prisma_access2.1 | 2.2

2 vendors · 4 products

References

1 links