CVE-2024-3387
Medium
Description
A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Paloaltonetworks Pan-os
PublishedApr 10, 2024
First seenApr 10, 2024
Weakness typeCWE-326CWE-326
How to fix
Update
- paloaltonetworks pan-os10.1.12, 10.2.7, 11.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| paloaltonetworks pan-os | 10.1.0 ≤ v < 10.1.12, 10.2.0 ≤ v < 10.2.7, 11.0.0 ≤ v < 11.0.4, 10.2.7 | 10.1.12, 10.2.7, 11.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.