PAN-OS: Privilege Escalation (PE) Vulnerability in XML API
CVE-2024-9471

4.7MEDIUM

Key Information:

Vendor

Palo Alto Networks
Status
Pan-os
Cloud Ngfw
Prisma Access
Vendor
CVE Published:
9 October 2024

Badges

👾 Exploit Exists

What is CVE-2024-9471?

A privilege escalation vulnerability exists within the XML API of Palo Alto Networks PAN-OS software. This security flaw allows an authenticated administrator with limited access to exploit a compromised XML API key, potentially executing actions that would typically be restricted. For instance, an administrator who is designated as a 'Virtual system administrator (read-only)' may misuse another admin's XML API key, granting them unauthorized write capabilities on the virtual system's configuration. This situation underscores the importance of safeguarding API keys and enforcing stringent access controls to maintain network security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PAN-OS 11.0.0 < 11.0.3

PAN-OS 10.1.0 < 10.1.11

PAN-OS 10.2.0 < 10.2.8

References

https://security.paloaltonetworks.com/CVE-2024-9471
vendor-advisory

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

Credit

Palo Alto Networks thanks an external reporter for discovering and reporting this issue.
JSON
.