CyberCVE

CVE-2024-9471

PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

Severity
Medium 5.1
CVSS 4.0
Exploited
Not listed
EPSS
0.003
21.6th percentile
Discovered by
Third party
Published by the vendor
Published
Oct 9, 2024
Assigned by palo_alto

Description

A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system administrator" to perform write operations on the virtual system configuration even though they should be limited to read-only operations.

Weakness: CWE-269

Affected products

Vendor Product Category Matched by
Palo Alto Networks Cloud NGFW Firewall / NGFW cna-assigner
Palo Alto Networks PAN-OS Firewall / NGFW cna-assigner
Palo Alto Networks Prisma Access SASE / SSE / Secure Web cna-assigner
Vendor-reported affected versions (4)
  • Palo Alto Networks · PAN-OS
  • Palo Alto Networks · Cloud NGFW
  • Palo Alto Networks · Prisma Access
  • paloaltonetworks · pan-os

Credit

Palo Alto Networks thanks an external reporter for discovering and reporting this issue.

Vendor remediation

This issue is fixed in PAN-OS 10.1.11, PAN-OS 10.2.8, PAN-OS 11.0.3, and all later PAN-OS versions.

References