What is PAN-SA-2016-0010?

PAN-SA-2016-0010 is a security advisory published by Palo Alto Networks Security Advisories with None severity. PAN-SA-2016-0010 Update Server API Exposure

Why does PAN-SA-2016-0010 have no CVE ID yet?

Palo Alto Networks Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by PAN-SA-2016-0010?

PAN-SA-2016-0010 affects 1 product, including: Update server.

PAN-SA-2016-0010NoneDisclosed before NVD

PAN-SA-2016-0010 Update Server API Exposure

Vendor

Palo Alto Networks Security Advisories

Published

July 1, 2016

Last Modified

July 1, 2016

📋 Description

The Palo Alto Networks update server enables downloading of PAN-OS software releases and dynamic updates through a public API. Some functions of the API were inadvertently exposed to the public. API functions publicly available and exclusively used by internal workflow allowed for remote call. This did not affect Palo Alto Networks customers’ security posture, but some Palo Alto Networks update server data could be accessed. This issue affects Palo Alto Networks update server

🎯 Affected products1

Update server

✅ Remediation

N/A Workarounds and mitigations: API functions that are utilized only by Palo Alto Networks backend systems have been migrated to an internal-facing only server. Externally facing functions that were deprecated or unused have been removed from the public-facing server.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/PAN-SA-2016-0010