CVE-2024-9471 MEDIUM

CVE-2024-9471: PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

Vendor Palo Alto Networks
Product PAN-OS
Weakness CWE-269
Published October 9, 2024
Last update October 18, 2024

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Green

What the vulnerability does

01Description

A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system administrator" to perform write operations on the virtual system configuration even though they should be limited to read-only operations.

Key dates

02Disclosure timeline

October 9, 2024 CVE published
October 18, 2024 Record updated