CVE-2024-0008

PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface

Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2023-0003

Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Fedoraproject Paloaltonetworks

Products

Fedora Cortex Xsoar

CVE-2023-0004

PAN-OS: Local File Deletion Vulnerability

A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of PAN-OS software.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Fedoraproject Paloaltonetworks

Products

Fedora Pan-os

CVE-2023-38046

PAN-OS: Read System Files and Resources During Configuration Commit

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2023-0005

PAN-OS: Exposure of Sensitive Information Vulnerability

A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device configuration and encrypted API keys.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2023-0008

PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface

A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to export local files from the firewall through a race condition.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2023-0006

GlobalProtect App: Local File Deletion Vulnerability

A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges through a race condition.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Globalprotect

CVE-2023-0007

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to store a JavaScript payload in the web interface that will execute in the context of another administrator’s browser when viewed.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os Panorama M-200 Panorama M-500 and 1 more

CVE-2024-3388

PAN-OS: User Impersonation in GlobalProtect SSL VPN

A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os Prisma Access

CVE-2024-5919

PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2024-5917

PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Cloud Ngfw Pan-os

CVE-2024-2552

PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2024-2551

PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet

A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2024-2550

PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet

A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2024-5913

PAN-OS: Improper Input Validation Vulnerability in PAN-OS

An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system to elevate privileges.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2024-3384

PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets

A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2024-3383

PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)

A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2024-3661

DHCP routing options can manipulate interface-based VPN traffic

DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN.

CVSS 3.1 · 7.6 High EPSS 4.1% KEV · Not listed

Vendors

Apple Cisco Citrix and 7 more

Products

Iphone Os Macos Anyconnect Vpn Client and 10 more

CVE-2023-0010

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Pan-os

CVE-2023-0009

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Paloaltonetworks

Products

Globalprotect