Attacker can perform MitM attack to capture encrypted traffic
CVE-2024-3387

5.3MEDIUM

Key Information:

Vendor

Palo Alto Networks
Status
Pan-os
Cloud Ngfw
Prisma Access
Vendor
CVE Published:
10 April 2024

What is CVE-2024-3387?

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PAN-OS 10.1.0 < 10.1.12

PAN-OS 10.2.0 < 10.2.7-h3

PAN-OS 10.2.0 < 10.2.8

References

https://security.paloaltonetworks.com/CVE-2024-3387

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Palo Alto Networks thanks one of our customers for discovering and reporting this issue.
JSON
.