Log in Start free

Vulnerability · Published Mar 13, 2024 · Assigned by palo_alto

CVE-2024-2433PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss

Medium 4.3

In plain English

A medium-severity privilege mismanagement in Cloud NGFW from Palo Alto Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of the management plane; the dataplane is unaffected.

Affected products (as reported)

VendorProductVersions
Palo Alto Networks PAN-OS 9.0 – before 9.0.17-h49.1 – before 9.1.1710.1 – before 10.1.1210.2 – before 10.2.811.0 – before 11.0.3
Palo Alto Networks Cloud NGFW see references
Palo Alto Networks Prisma Access see references

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References