How to Patch Vulnerability - Plugin 43160 (CGI Generic SQL Injection) on GlobalProtect

[P.Namtien]

Body: We have detected a blind SQL injection vulnerability (Plugin ID: 43160) on GlobalProtect login CGI (/global-protect/login.esp) using Nessus.

Details: - CVSS Score: 7.5 (High) - Affected Parameter: 'action' - Example: /global-protect/login.esp?action=';WAITFOR DELAY '00:00:3';--

Environment: PAN-OS version: [Your Version] GlobalProtect Portal: [Your Portal URL]

Question: What is the recommended patch or configuration to mitigate this vulnerability?

Is there an official fix or workaround from Palo Alto Networks?

References: https://www.nessus.org/u?ed792cf5 https://projects.webappsec.org/w/page/13246963/SQL%20Injection

[P.Namtien]

Software Version

11.2.4-h7