CVE-2024-3388 — Improper Privilege Management in Palo Alto Networks Pan-os

CWE-269 — Improper Privilege ManagementCWE-863 — Incorrect Authorization4 documents4 sources
Severity
5.0MEDIUMNVD
CNA4.1
EPSS
0.2%
top 62.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Palo Alto Networks Pan-osPalo Alto Networks Prisma AccessPaloaltonetworks Pan-os+3 more
Timeline
PublishedApr 10

Description

A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:NExploitability: 3.1 | Impact: 1.4

Affected Packages6 packages

▶NVDpaloaltonetworks/pan-os8.1.0 — 8.1.26+8
▶CVEListV5palo_alto_networks/pan-os8.1.0 — 8.1.26+5
▶CVEListV5palo_alto_networks/prisma_access10.2 — 10.2.4
▶Palo Altopaloalto/pan-os

🔴Vulnerability Details

2
CVEList
PAN-OS: User Impersonation in GlobalProtect SSL VPN↗2024-04-10
▶
GHSA
GHSA-wmmf-r63x-5jrw: A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and s↗2024-04-10
▶

📋Vendor Advisories

1
Palo Alto
PAN-OS: User Impersonation in GlobalProtect SSL VPN↗2024-04-10
▶
CVE-2024-3388 — Improper Privilege Management in Palo | cvebase