CVE-2024-2433 — Improper Privilege Management in Palo Alto Networks Pan-os

CWE-269 — Improper Privilege Management4 documents4 sources
Severity
2.7LOWNVD
CNA4.3
EPSS
0.1%
top 84.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Palo Alto Networks Pan-osPaloaltonetworks Pan-osPaloalto Cloud Ngfw+2 more
Timeline
PublishedMar 13

Description

An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of the management plane; the dataplane is unaffected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:LExploitability: 1.2 | Impact: 1.4

Affected Packages5 packages

▶NVDpaloaltonetworks/pan-os9.1.0 — 9.1.17+5
▶CVEListV5palo_alto_networks/pan-os9.0 — 9.0.17-h4+4
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
GHSA
GHSA-93p2-3fjv-r8vv: An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using↗2024-03-13
▶
CVEList
PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss↗2024-03-13
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss↗2024-03-13
▶
CVE-2024-2433 — Improper Privilege Management in Palo | cvebase