Description
A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.
CVSS breakdown
CVSS 4.0
Attack Vector
Adjacent
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
High
Integrity (Vulnerable System)
High
Availability (Vulnerable System)
High
Confidentiality (Subsequent System)
Low
Integrity (Subsequent System)
Low
Availability (Subsequent System)
None
E
Unchanged
AU
Y
R
Unchanged
V
Changed
RE
M
U
Amber
Affected products
- Palo Alto Networks / Trust Protection Foundation25.3.0 – 25.3.3
- Palo Alto Networks / Trust Protection Foundation25.1.0 – 25.1.8
- Palo Alto Networks / Trust Protection Foundation24.3.0 – 24.3.6
- Palo Alto Networks / Trust Protection Foundation24.1.0 – 24.1.13