CVE-2013-5663

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-08-31 · updated 2026-06-16
Weakness: CWE-264

Description

The App-ID cache feature in Palo Alto Networks PAN-OS before 4.0.14, 4.1.x before 4.1.11, and 5.0.x before 5.0.2 allows remote attackers to bypass intended security policies via crafted requests that trigger invalid caching, as demonstrated by incorrect identification of HTTP traffic as SIP traffic, aka Ref ID 47195.

Affected products

Palo Alto Networks PAN-OS: through 4.0.8; 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 (+16) (and their updates)

References

http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx
http://pastie.org/pastes/5568186/text
http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update/
https://security.paloaltonetworks.com/CVE-2013-5663
http://cansecwest.com/csw11/Network%20Application%20FW%20vs.%20Contemporary%20Threats%20%28Brad%20Woodberg%20-%20Final%29.pptx
http://pastie.org/pastes/5568186/text
http://researchcenter.paloaltonetworks.com/2013/01/app-id-cache-pollution-update/
https://security.paloaltonetworks.com/CVE-2013-5663

Get alerted when CVE-2013-5663 or the next vulnerability affects your stack