dbcve.org
Pan OsOperating system · Paloaltonetworks

CVE-2022-0011

MEDIUM · 6.5 CVSS v3.1 Published 2022-02-10
Fix available
A fix is available. Upgrade to 8.1.21 / 9.1.12 or later.
See remediation →
71/100
Remediation priority · Elevated
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

PAN-OS URL filtering allows custom URL category lists or external dynamic lists (EDL) to exclude websites from category enforcement. However, hostname patterns that lack a trailing forward slash (/) or end with * or ^ match more URLs than intended - for example, example.com matches example.com.website.test, example.com.* matches any subdomain, and example.com.^ matches any TLD. This can inadvertently allow malicious URLs that should be blocked.

MitigationReview all custom URL category lists and EDL entries to ensure hostname patterns end with / for exact matching; remove or modify wildcard patterns (* and ^) that broaden matching scope beyond intent.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Pan OsOperating system
Affected:>= 8.1.0, < 8.1.21>= 9.0.0, <= 9.0.15>= 9.1.0, < 9.1.12>= 10.0.0, < 10.0.8>= 10.1.0, < 10.1.3
Prisma AccessApplication
Affected:= 2.1= 2.2

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify PAN-OS version
    Check the installed PAN-OS version in the device dashboard under Device > Support or by running 'show system info' in the CLI
    Affected if Version falls within 8.1.0-8.1.20, 9.0.0-9.0.15, 9.1.0-9.1.11, 10.0.0-10.0.7, or 10.1.0-10.1.2, or Prisma Access 2.1/2.2
  2. Confirm URL filtering is active
    Verify that URL filtering is enabled in the security policy by reviewing Objects > URL Categories or checking active security profiles in Policies > Security
    Affected if URL filtering policy with custom categories or EDL-based enforcement is configured and active
  3. Review custom URL category entries
    Navigate to Objects > Custom URL Categories and inspect each entry for hostname patterns that lack a trailing forward slash or end with * or ^
    Affected if Any custom URL category contains patterns like 'example.com', 'example.com.*', or 'example.com^' without trailing slash
  4. Inspect external dynamic list configurations
    Navigate to Objects > External Dynamic Lists and examine each EDL used in URL filtering for hostname patterns missing trailing slash or ending with wildcard characters
    Affected if Any EDL contains patterns like 'example.com', 'example.com.*', or 'example.com^' without proper termination

You are affected if running a vulnerable PAN-OS or Prisma Access version AND you have custom URL categories or EDLs with hostname patterns that lack a trailing slash or contain wildcard characters (* or ^) used in your URL filtering policy.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 8.1.21 / 9.1.12 / 10.0.8 or later
Fixed in 8.1.219.1.1210.0.8
Interim mitigation

Review all custom URL category lists and EDL entries to ensure hostname patterns end with / for exact matching; remove or modify wildcard patterns (* and ^) that broaden matching scope beyond intent.

Recommended fix High confidence

PAN-OS: 8.1.21+, 9.0.16+, 9.1.12+, 10.0.8+, 10.1.3+ | Prisma Access: 2.3+

  1. 1. Identify the currently installed PAN-OS or Prisma Access version from the dashboard or via 'show system info' command.
  2. 2. For PAN-OS 8.1.x deployments: Upgrade to PAN-OS 8.1.21 or later.
  3. 3. For PAN-OS 9.0.x deployments: Upgrade to PAN-OS 9.0.16 or later (9.0.16 includes the fix).
  4. 4. For PAN-OS 9.1.x deployments: Upgrade to PAN-OS 9.1.12 or later.
  5. 5. For PAN-OS 10.0.x deployments: Upgrade to PAN-OS 10.0.8 or later.
  6. 6. For PAN-OS 10.1.x deployments: Upgrade to PAN-OS 10.1.3 or later (if on 10.1.0-10.1.2).
  7. 7. For Prisma Access deployments: Upgrade to Prisma Access 2.3 or later.
  8. 8. After upgrade, verify that existing URL filtering policies still function correctly by testing with the previously excluded hostname patterns.
Caveat Review release upgrade notes for potential compatibility impacts; test in staging environment before production deployment

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Pan Os Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-0011 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-0011 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data