{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-0011",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-0011",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2022-02-10T18:10:15.524Z",
    "updatedAt": "2024-09-16T23:51:26.574Z",
    "importedAt": "2026-10-24T01:56:36.661Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering",
      "summary": "PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these lists have a hostname pattern that does not end with a forward slash (/) or a hostname pattern that ends with an asterisk (*), any URL that starts with the specified pattern is considered a match. Entries with a caret (^) at the end of a hostname pattern match any top level domain. This may inadvertently allow or block more URLs than intended and allowing more URLs than intended represents a security risk. For example: example.com will match example.com.website.test example.com.* will match example.com.website.test example.com.^ will match example.com.test You should take special care when using such entries in policy rules that allow traffic. Where possible, use the exact list of hostname names ending with a forward slash (/) instead of using wildcards. PAN-OS 10.1 versions earlier than PAN-OS 10.1.3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 9.1 versions earlier than PAN-OS 9.1.12; all PAN-OS 9.0 versions; PAN-OS 8.1 versions earlier than PAN-OS 8.1.21, and Prisma Access 2.2 and 2.1 versions do not allow customers to change this behavior without changing the URL category list or EDL.",
      "affected": [
        {
          "vendor": "Palo Alto Networks",
          "product": "PAN-OS",
          "versions": [
            {
              "version": "9.0.*",
              "status": "affected"
            },
            {
              "version": "8.1",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "8.1.21",
              "changes": [
                {
                  "at": "8.1.21",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "9.1",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "9.1.12",
              "changes": [
                {
                  "at": "9.1.12",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "10.0",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "10.0.8",
              "changes": [
                {
                  "at": "10.0.8",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "10.1",
              "status": "affected",
              "versionType": "custom",
              "lessThan": "10.1.3",
              "changes": [
                {
                  "at": "10.1.3",
                  "status": "unaffected"
                }
              ]
            }
          ]
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "Prisma Access",
          "versions": [
            {
              "version": "3.0 Preferred, Innovation",
              "status": "unaffected"
            },
            {
              "version": "2.2 Preferred",
              "status": "affected"
            },
            {
              "version": "2.1 Preferred, Innovation",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}