CVE-2022-0011

PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL.

• CWE-436
• CWE-436

• https://security.paloaltonetworks.com/CVE-2022-0011Mitigation, Vendor Advisory
• https://security.paloaltonetworks.com/CVE-2022-0011Mitigation, Vendor Advisory

Published

Feb 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0001Non-transparent sharing of branch predictor selectors betwee…6.5
• CVE-2022-0002Non-transparent sharing of branch predictor within a context…6.5
• CVE-2022-0003Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-0004Hardware debug modes and processor INIT setting that allow o…6.8
• CVE-2022-0005Sensitive information accessible by physical probing of JTAG…2.4
• CVE-2022-0010Insertion of Sensitive Information into Log File vulnerabili…5.5
• CVE-2022-0012An improper link resolution before file access vulnerability…7.1
• CVE-2022-0013A file information exposure vulnerability exists in the Palo…5.5
• CVE-2022-0014An untrusted search path vulnerability exists in the Palo Al…7.3
• CVE-2022-0015A local privilege escalation (PE) vulnerability exists in th…7.8
• CVE-2022-0016An improper handling of exceptional conditions vulnerability…7.8
• CVE-2022-0017An improper link resolution before file access ('link follow…7.8