Vulnerability · Published Apr 10, 2024 · Assigned by palo_alto
CVE-2024-3383PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)
High 7.4
In plain English
A high-severity security flaw in Cloud NGFW from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | PAN-OS | 11.0.0 – before 11.0.310.2.0 – before 10.2.510.1.0 – before 10.1.11 |
| Palo Alto Networks | Cloud NGFW | see references |
| Palo Alto Networks | Prisma Access | see references |
Weakness: CWE-282 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H