CVE-2022-0011
PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering
02 Description
PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.66% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 51.1% of scored records. A rank, not a probability.
- NVD base score
- 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2022-02-10 18:10Z4 YR AGO
- Last updated
- 2024-09-16 23:51Z2 YR AGO
- Reserved
- 2021-12-28
- Assigning CNA
- palo_alto
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 6.5)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-436Interpretation ConflictClass
- Data version
- 5.1
- Document digest
- 6df7dafb1c15c3b7a880144d784781bd166ab7fbd71cfce420841bdf872973c5
05 Affected products
06 References
- security.paloaltonetworks.comhttps://security.paloaltonetworks.com/CVE-2022-0011
07 Remediation
PAN-OS 8.1.21, PAN-OS 9.1.12, PAN-OS 10.0.8, PAN-OS 10.1.3, Prisma Access 3.0 Preferred, and Prisma Access 3.0 Innovation all include a customer configurable option to automatically append a forward slash at the end of the hostname pattern for entries without an ending token in a custom URL category list or in an external dynamic list (EDL). Prisma Access customers should refer to “STEP 7” in the following Prisma Access 3.0 documentation to enable this feature: https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-prisma-access-infrastructure/prisma-access-service-infrastructure/enable-the-service-infrastructure.html For other PAN-OS appliances, this option is enabled by running these CLI commands: debug device-server append-end-token on commit force Note: This option is disabled by default on PAN-OS 8.1, PAN-OS 9.1, PAN-OS 10.0, and PAN-OS 10.1. This option will be enabled by default starting with the next major version of PAN-OS. This option is not available on PAN-OS 9.0. Customers with PAN-OS 9.0 are advised to apply workarounds or upgrade to PAN-OS 9.1 or a later version. Additionally, customers must evaluate their custom URL category list or their external dynamic list (EDL) and any firewall policy rules that depend on them to determine whether this option provides the desired policy rule enforcement. Example 1: If the firewall policy rule is intended to allow only 'www.example.com' and not to allow access to any other