CVE-2024-5917
PAN-OS: Server-Side Request Forgery in WildFire
Severity
Low 2.1
CVSS 4.0
Exploited
Not listed
EPSS
0.005
38.9th percentile
Discovered by
Third party
Published by the vendor
Published
Nov 14, 2024
Assigned by palo_alto
Description
A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible.
Weakness: CWE-918
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW | Firewall / NGFW | cna-assigner |
| Palo Alto Networks | PAN-OS | Firewall / NGFW | cna-assigner |
Vendor-reported affected versions (7)
- Palo Alto Networks · Cloud NGFW
- Palo Alto Networks · PAN-OS
- paloaltonetworks · cloud_ngfw
- paloaltonetworks · pan-os
- paloaltonetworks · pan-os
- paloaltonetworks · pan-os
- paloaltonetworks · pan-os
Credit
Michael Baker from AC3
Vendor remediation
This issue is fixed in PAN-OS 10.1.7, PAN-OS 10.2.2, and all later PAN-OS versions.