CVE-2024-0008
PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
Severity
Medium 6.6
CVSS 3.1
Exploited
Not listed
EPSS
0.005
42.1th percentile
Discovered by
Third party
Vendor-published field
Published
Feb 14, 2024
Assigned by palo_alto
Description
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
Weakness: CWE-613
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | PAN-OS | Firewall / NGFW | cna-assigner |
Vendor-reported products (3)
- Palo Alto Networks · PAN-OS
- Palo Alto Networks · Prisma Access — vendor states not affected
- Palo Alto Networks · Cloud NGFW — vendor states not affected
Credit
Palo Alto Networks thanks Brian Yaklin for discovering and reporting this issue.
Vendor remediation
This issue is fixed in PAN-OS 9.0.17-h2, PAN-OS 9.1.17, PAN-OS 10.0.12-h1, PAN-OS 10.1.10-h1, PAN-OS 10.2.5, PAN-OS 11.0.2, and all later PAN-OS versions.