Description
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.
CVSS breakdown
CVSS 4.0
Attack Vector
Adjacent
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
High
Integrity (Vulnerable System)
High
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
Low
Integrity (Subsequent System)
Low
Availability (Subsequent System)
None
E
Unchanged
AU
None
R
Unchanged
V
D
RE
M
U
Amber
Affected products
- Palo Alto Networks / Trust Protection Foundation25.3.0 – 25.3.3
- Palo Alto Networks / Trust Protection Foundation25.1.0 – 25.1.8
- Palo Alto Networks / Trust Protection Foundation24.3.0 – 24.3.6
- Palo Alto Networks / Trust Protection Foundation24.1.0 – 24.1.13