CVE-2024-0008
published 2024-02-14CVE-2024-0008: Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized…
PriorityP348high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.50%
39.2th percentile
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| palo_alto_networks | pan-os | >= 10.0 < 10.0.12-h1 | 10.0.12-h1 |
| palo_alto_networks | pan-os | >= 10.0 < 10.0.13 | 10.0.13 |
| palo_alto_networks | pan-os | >= 10.1 < 10.1.10-h1 | 10.1.10-h1 |
| palo_alto_networks | pan-os | >= 10.1 < 10.1.11 | 10.1.11 |
| palo_alto_networks | pan-os | >= 10.2 < 10.2.5 | 10.2.5 |
| palo_alto_networks | pan-os | >= 11.0 < 11.0.2 | 11.0.2 |
| palo_alto_networks | pan-os | >= 9.0 < 9.0.17-h2 | 9.0.17-h2 |
| palo_alto_networks | pan-os | >= 9.0 < 9.0.18 | 9.0.18 |
| palo_alto_networks | pan-os | >= 9.1 < 9.1.17 | 9.1.17 |
| paloalto | cloud_ngfw | — | — |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | — | — |
| paloaltonetworks | pan-os | >= 10.0.0 < 10.0.12 | 10.0.12 |
| paloaltonetworks | pan-os | >= 10.1.0 < 10.1.10 | 10.1.10 |
| paloaltonetworks | pan-os | >= 10.2.0 < 10.2.5 | 10.2.5 |
| paloaltonetworks | pan-os | >= 11.0.0 < 11.0.2 | 11.0.2 |
| paloaltonetworks | pan-os | >= 9.0.0 < 9.0.17 | 9.0.17 |
| paloaltonetworks | pan-os | >= 9.1.0 < 9.1.17 | 9.1.17 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: bpf: Check the validity of nr_words in bpf_iter_bits_new()
vendor_redhat·2024-11-09·CVSS 5.5
CVE-2024-50253 [MEDIUM] CWE-190 kernel: bpf: Check the validity of nr_words in bpf_iter_bits_new()
kernel: bpf: Check the validity of nr_words in bpf_iter_bits_new()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check the validity of nr_words in bpf_iter_bits_new()
Check the validity of nr_words in bpf_iter_bits_new(). Without this
check, when multiplication overflow occurs for nr_bits (e.g., when
nr_words = 0x0400-0001, nr_bits becomes 64), stack corruption may occur
due to bpf_probe_read_kernel_common(..., nr_bytes = 0x2000-0008).
Fix it by limiting the maximum value of nr_words to 511. The value is
derived from the current implementation of BPF memory allocator. To
ensure compatibility if the BPF memory allocator's size limitation
changes in the future, use the helper bpf_mem_alloc_check_size() to
check whether nr_bytes is too larger. And return -E2BIG ins
Palo Alto
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-09-04·CVSS 6.0
CVE-2022-22965 [MEDIUM] PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2010-1622, CVE-2015-7552, CVE-2018-16840, CVE-2019-7639, CVE-2020-17049, CVE-2020-7774, CVE-2021-0131, CVE-2021-0132, CVE-2021-0133, CVE-2021-0134, CVE-2021-4044, CVE-2021-4160, CVE-2021-41773, CVE-2022-1343, CVE-2022-21449, CVE-2022-2274, CVE-2022-22963, CVE-2022-22965, CVE-2022-24697, CVE-2022-32207, CVE-2022-3358, CVE-2022-3996, CVE-2022-40664, CVE-2022-44792, CVE-2022-44793, CVE-2023-1255, CVE-2023-22809, CVE-2023-23919, CVE-2023-3341, CVE-2023-4236, CVE-2023-4863, CVE-2023-51767
Affected products: PAN-OS
CISA ICS
Siemens RUGGEDCOM APE1808
cisa_ics·2024-04-11·CVSS 7.5
[HIGH] Siemens RUGGEDCOM APE1808
ICS Advisory
##
Siemens RUGGEDCOM APE1808
Release DateApril 11, 2024
Alert CodeICSA-24-102-04
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.2
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM APE1808
- Vulnerabilities: Cross-site Scripting, Improper Privilege Management, Improper Check for Unusual or Exceptional Conditions, Truncation of Security-relevant Information, Insufficient Session Expiration
#
VMware
VMware SD-WAN Edge and SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2024-22246, CVE-2024-22247, CVE-2024-22248)
vendor_vmware·2024-04-02·CVSS 7.4
CVE-2024-22246 [HIGH] VMware SD-WAN Edge and SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2024-22246, CVE-2024-22247, CVE-2024-22248)
VMSA-2024-0008: VMware SD-WAN Edge and SD-WAN Orchestrator updates address multiple security vulnerabilities (CVE-2024-22246, CVE-2024-22247, CVE-2024-22248)
VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.4.
CVEs: CVE-2024-22246, CVE-2024-22247, CVE-2024-22248
Affected products: VMware SD-WAN, VMware VeloCloud
Palo Alto
PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
vendor_paloalto·2024-02-14·CVSS 8.8
CVE-2024-0008 [HIGH] CWE-613 PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
Affected products: Cloud NGFW, PAN-OS, Prisma Access
Solution: This issue is fixed in PAN-OS 9.0.17-h2, PAN-OS 9.1.17, PAN-OS 10.0.12-h1, PAN-OS 10.1.10-h1, PAN-OS 10.2.5, PAN-OS 11.0.2, and all later PAN-OS versions.
Workaround: Ensure that inactivity-based screen locks are enforced on endpoints with access to the PAN-OS web interface.
GHSA
GHSA-3wmf-6xrp-7qch: Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthori
ghsa_unreviewed·2024-02-14
CVE-2024-0008 [MEDIUM] CWE-613 GHSA-3wmf-6xrp-7qch: Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthori
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
No detection rules found.
No public exploits indexed.
2024-02-14
Published