CVE-2024-2433
Medium
Description
An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images. This issue affects only the web interface of the management plane; the dataplane is unaffected.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Paloaltonetworks Pan-os
PublishedMar 13, 2024
First seenMar 13, 2024
Weakness typeCWE-269Improper privilege management
How to fix
Update
- paloaltonetworks pan-os9.0.17, 9.1.17, 10.1.12, 10.2.8, 11.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| paloaltonetworks pan-os | v < 9.0.17, 9.1.0 ≤ v < 9.1.17, 10.1.0 ≤ v < 10.1.12, 10.2.0 ≤ v < 10.2.8, 11.0.0 ≤ v < 11.0.3, 9.0.17 | 9.0.17, 9.1.17, 10.1.12, 10.2.8, 11.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.