CVE-2025-2180

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-2180", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "state": "PUBLISHED", "assignerShortName": "palo_alto", "dateReserved": "2025-03-10T17:56:22.502Z", "datePublished": "2025-08-13T17:02:47.899Z", "dateUpdated": "2025-08-13T17:21:30.216Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Checkov by Prisma Cloud", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "3.2.415", "status": "unaffected"}], "lessThan": "3.2.415", "status": "affected", "version": "3.2.0", "versionType": "custom"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span>No special configuration is required to be vulnerable to this issue.</span>"}], "value": "No special configuration is required to be vulnerable to this issue."}], "credits": [{"lang": "en", "type": "finder", "value": "Palo Alto Networks thanks Bryan Eastes for discovering and reporting this issue."}], "datePublic": "2025-08-13T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma\u00ae Cloud.<br><br>This issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415."}], "value": "An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma\u00ae Cloud.\n\nThis issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 4.8, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "If the user scans infrastructure as code (IaC) files from untrusted sources."}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2025-08-13T17:02:47.899Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://security.paloaltonetworks.com/CVE-2025-2180"}], "solutions": [{"lang": "eng", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Checkov by Prisma Cloud 3.2<br></td>\n <td>3.2.0 through 3.2.414</td>\n <td>Upgrade to 3.2.415 or later.</td>\n </tr></tbody></table>"}], "value": "Version\nMinor Version\nSuggested Solution\n\n Checkov by Prisma Cloud 3.2\n\n 3.2.0 through 3.2.414\n Upgrade to 3.2.415 or later."}], "source": {"defect": ["BCE-44235"], "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2025-08-13T16:00:00.000Z", "value": "Initial publication"}], "title": "Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Do not run Checkov on terraform files from untrusted sources or pull requests."}], "value": "Do not run Checkov on terraform files from untrusted sources or pull requests."}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-13T17:20:30.282985Z", "id": "CVE-2025-2180", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-13T17:21:30.216Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2180", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-13T17:20:30.282985Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-13T17:21:25.289Z"}}], "cna": {"title": "Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution", "source": {"defect": ["BCE-44235"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Palo Alto Networks thanks Bryan Eastes for discovering and reporting this issue."}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 4.8, "Automatable": "NO", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/AU:N/R:U/V:D/RE:M/U:Amber", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "If the user scans infrastructure as code (IaC) files from untrusted sources."}]}], "affected": [{"vendor": "Palo Alto Networks", "product": "Checkov by Prisma Cloud", "versions": [{"status": "affected", "changes": [{"at": "3.2.415", "status": "unaffected"}], "version": "3.2.0", "lessThan": "3.2.415", "versionType": "custom"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "supportingMedia": [{"type": "text/html", "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.", "base64": false}]}], "timeline": [{"lang": "en", "time": "2025-08-13T16:00:00.000Z", "value": "Initial publication"}], "solutions": [{"lang": "eng", "value": "Version\nMinor Version\nSuggested Solution\n\n Checkov by Prisma Cloud 3.2\n\n 3.2.0 through 3.2.414\n Upgrade to 3.2.415 or later.", "supportingMedia": [{"type": "text/html", "value": "<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n <td>Checkov by Prisma Cloud 3.2<br></td>\n <td>3.2.0 through 3.2.414</td>\n <td>Upgrade to 3.2.415 or later.</td>\n </tr></tbody></table>", "base64": false}]}], "datePublic": "2025-08-13T16:00:00.000Z", "references": [{"url": "https://security.paloaltonetworks.com/CVE-2025-2180", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Do not run Checkov on terraform files from untrusted sources or pull requests.", "supportingMedia": [{"type": "text/html", "value": "Do not run Checkov on terraform files from untrusted sources or pull requests.", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma\u00ae Cloud.\n\nThis issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415.", "supportingMedia": [{"type": "text/html", "value": "An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma\u00ae Cloud.<br><br>This issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "configurations": [{"lang": "en", "value": "No special configuration is required to be vulnerable to this issue.", "supportingMedia": [{"type": "text/html", "value": "<span>No special configuration is required to be vulnerable to this issue.</span>", "base64": false}]}], "providerMetadata": {"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "shortName": "palo_alto", "dateUpdated": "2025-08-13T17:02:47.899Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2180", "state": "PUBLISHED", "dateUpdated": "2025-08-13T17:21:30.216Z", "dateReserved": "2025-03-10T17:56:22.502Z", "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0", "datePublished": "2025-08-13T17:02:47.899Z", "assignerShortName": "palo_alto"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Checkov by Prisma Cloud", "vendor": "Palo Alto Networks", "versions": [{"changes": [{"at": "3.2.415", "status": "unaffected"}], "lessThan": "3.2.415", "status": "affected", "version": "3.2.0", "versionType": "custom"}]}], "source": "psirt@paloaltonetworks.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma\u00ae Cloud.\n\nThis issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415."}, {"lang": "es", "value": "Una vulnerabilidad de deserializaci\u00f3n insegura en Palo Alto Networks Checkov by Prisma\u00ae Cloud permite que un usuario autenticado ejecute c\u00f3digo arbitrario como usuario no administrativo escaneando un archivo malicioso de Terraform al usar Checkov en Prisma\u00ae Cloud. Este problema afecta a versiones de Checkov 3.0 anteriores a la 3.2.415."}], "id": "CVE-2025-2180", "lastModified": "2026-06-17T09:06:28.880", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "USER", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "AMBER", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "source": "psirt@paloaltonetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2180", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-13T17:20:30.282985Z", "version": "2.0.3"}}]}, "published": "2025-08-13T17:15:25.973", "references": [{"source": "psirt@paloaltonetworks.com", "url": "https://security.paloaltonetworks.com/CVE-2025-2180"}], "sourceIdentifier": "psirt@paloaltonetworks.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "psirt@paloaltonetworks.com", "type": "Secondary"}]}

{}

{"created": "2025-08-14T12:59:57.576666+00:00", "updated": "2025-08-14T12:59:57.576727+00:00", "vendors": ["paloaltonetworks", "paloaltonetworks$PRODUCT$checkov"]}