CVE-2024-5919

PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

Severity
Medium 5.1
CVSS 4.0
Exploited
Not listed
EPSS
0.003
27.4th percentile
Discovered by
Third party
Vendor-published field
Published
Nov 14, 2024
Assigned by palo_alto

Description

A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.

Weakness: CWE-611

Affected products

Vendor Product Category Matched by
Palo Alto Networks PAN-OS Firewall / NGFW cna-assigner
Vendor-reported products (3)
  • Palo Alto Networks · Cloud NGFW — vendor states not affected
  • Palo Alto Networks · PAN-OS
  • Palo Alto Networks · Prisma Access — vendor states not affected

Credit

Dan Marin of Deloitte

Vendor remediation

This issue is fixed in PAN-OS 10.1.10, PAN-OS 10.2.5, PAN-OS 11.0.2, and all later PAN-OS versions.

Something wrong here?