Lucene search

Palo_altoCVE-2024-5913

HistoryJul 10, 2024 - 7:15 p.m.

CVE-2024-5913

2024-07-1019:15:11

CWE-20

palo_alto

web.nvd.nist.gov

142

palo alto networks

input validation

file system tampering

privilege elevation

CVSS3

6.1

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.2

Confidence

Low

EPSS

Percentile

9.3%

JSON

An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system to elevate privileges.

Affected configurations

Vulners

Vulnrichment

Node

paloaltonetworkspan-osRange10.1.0–10.1.14

Node

paloaltonetworkspan-osRange10.2.0–10.2.10

Node

paloaltonetworkspan-osRange11.0.0–11.0.5

Node

paloaltonetworkspan-osRange11.1.0–11.1.4

Node

paloaltonetworkspan-osRange11.2.0–11.2.1

VendorProductVersionCPE
paloaltonetworkspan-os*cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
paloaltonetworks	pan-os	*	cpe:2.3:o:paloaltonetworks:pan-os::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PAN-OS",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "changes": [
          {
            "at": "10.1.14-h2",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.1.14-h2",
        "status": "affected",
        "version": "10.1.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "10.2.10",
            "status": "unaffected"
          }
        ],
        "lessThan": "10.2.10",
        "status": "affected",
        "version": "10.2.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "11.0.5",
            "status": "unaffected"
          }
        ],
        "lessThan": "11.0.5",
        "status": "affected",
        "version": "11.0.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "11.1.4",
            "status": "unaffected"
          }
        ],
        "lessThan": "11.1.4",
        "status": "affected",
        "version": "11.1.0",
        "versionType": "custom"
      },
      {
        "changes": [
          {
            "at": "11.2.1",
            "status": "unaffected"
          }
        ],
        "lessThan": "11.2.1",
        "status": "affected",
        "version": "11.2.0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Cloud NGFW",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "affected",
        "version": "None"
      },
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Prisma Access",
    "vendor": "Palo Alto Networks",
    "versions": [
      {
        "status": "affected",
        "version": "None"
      },
      {
        "status": "unaffected",
        "version": "All"
      }
    ]
  }
]

References

security.paloaltonetworks.com/CVE-2024-5913

Social References

CVSS3

6.1

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.2

Confidence

Low

EPSS

Percentile

9.3%

JSON

Related for CVE-2024-5913