Vulnerability · Published Jul 10, 2024 · Assigned by palo_alto

CVE-2024-5911PAN-OS: File Upload Vulnerability in the Panorama Web Interface

High 7.0

In plain English

A high-severity unrestricted file upload in Cloud NGFW from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.6%top 52.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which requires manual intervention to bring the Panorama back online.

Affected products (as reported)

Vendor	Product	Versions
Palo Alto Networks	PAN-OS	10.2.0 – before 10.2.410.1.0 – before 10.1.9
Palo Alto Networks	Cloud NGFW	see references
Palo Alto Networks	Prisma Access	see references

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

References

https://security.paloaltonetworks.com/CVE-2024-5911 vendor-advisory