Good afternoon, hope you are all well.
Some of you have reported these critical vulnerabilities to them, by Nesus Scan:
|TCP||443||CGI Generic Command Execution (time-based)||It may be possible to run arbitrary code on the remote web server.||The remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host.
Note that this script uses a time-based detection method which is less reliable than the basic method.
|Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.|
|TCP||443||CGI Generic SQL Injection (blind, time based)||A CGI application hosted on the remote web server is potentially prone to SQL injection attack.||By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.
An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.
Note that this script is experimental and may be prone to false positives.
|Modify the affected CGI scripts so that they properly escape arguments.|
Do you know if these two are false positives, if they can be mitigated with an adjustment or by performing an upgrade?
This was reported on PAN-OS 9.1.4 platform.
I remain attentive to your comments and suggestions
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!