cnvd - cnvd-2024-20504

cnvd-2024-20504

Vulnerability from cnvd

Title: Palo Alto Networks PAN-OS存在未明漏洞（CNVD-2024-20504）

Description:

Palo Alto Networks PAN-OS是美国Palo Alto Networks公司的一款下一代防火墙软件。

Palo Alto Networks PAN-OS存在安全漏洞，经过身份验证的攻击者可利用该漏洞冒充其他用户并向内部资产发送网络数据包。

Severity: 中

Patch Name: Palo Alto Networks PAN-OS存在未明漏洞（CNVD-2024-20504）的补丁

Patch Description:

Palo Alto Networks PAN-OS是美国Palo Alto Networks公司的一款下一代防火墙软件。

Palo Alto Networks PAN-OS存在安全漏洞，经过身份验证的攻击者可利用该漏洞冒充其他用户并向内部资产发送网络数据包。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://security.paloaltonetworks.com/CVE-2024-3388

Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-3388

Impacted products

Name
['Palo Alto Networks PAN-OS <9.0.17-h4', 'Palo Alto Networks PAN-OS <11.0.3', 'Palo Alto Networks PAN-OS <10.2.7-h3', 'Palo Alto Networks PAN-OS <10.1.11-h4', 'Palo Alto Networks PAN-OS <9.1.17', 'Palo Alto Networks PAN-OS <8.1.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-3388",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-3388"
    }
  },
  "description": "Palo Alto Networks PAN-OS\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u6b3e\u4e0b\u4e00\u4ee3\u9632\u706b\u5899\u8f6f\u4ef6\u3002\n\nPalo Alto Networks PAN-OS\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5192\u5145\u5176\u4ed6\u7528\u6237\u5e76\u5411\u5185\u90e8\u8d44\u4ea7\u53d1\u9001\u7f51\u7edc\u6570\u636e\u5305\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://security.paloaltonetworks.com/CVE-2024-3388",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-20504",
  "openTime": "2024-04-18",
  "patchDescription": "Palo Alto Networks PAN-OS\u662f\u7f8e\u56fdPalo Alto Networks\u516c\u53f8\u7684\u4e00\u6b3e\u4e0b\u4e00\u4ee3\u9632\u706b\u5899\u8f6f\u4ef6\u3002\r\n\r\nPalo Alto Networks PAN-OS\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5192\u5145\u5176\u4ed6\u7528\u6237\u5e76\u5411\u5185\u90e8\u8d44\u4ea7\u53d1\u9001\u7f51\u7edc\u6570\u636e\u5305\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Palo Alto Networks PAN-OS\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-20504\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Palo Alto Networks PAN-OS \u003c9.0.17-h4",
      "Palo Alto Networks PAN-OS \u003c11.0.3",
      "Palo Alto Networks PAN-OS \u003c10.2.7-h3",
      "Palo Alto Networks PAN-OS \u003c10.1.11-h4",
      "Palo Alto Networks PAN-OS \u003c9.1.17",
      "Palo Alto Networks PAN-OS \u003c8.1.2"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2024-3388",
  "serverity": "\u4e2d",
  "submitTime": "2024-04-15",
  "title": "Palo Alto Networks PAN-OS\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-20504\uff09"
}

CVE-2024-3388 (GCVE-0-2024-3388)

Vulnerability from cvelistv5

Published

2024-04-10 17:06

Modified

2024-08-01 20:12

Severity ?

4.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

CWE

CWE-269 - Improper Privilege Management
CWE-863 - Incorrect Authorization

Summary

A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.

References

▼	URL	Tags
	https://security.paloaltonetworks.com/CVE-2024-3388

Impacted products

Vendor

Product

Version

▼

Palo Alto Networks

PAN-OS

Version: 8.1.0   < 8.1.26
Version: 9.0.0   < 9.0.17-h4
Version: 9.1.0   < 9.1.17
Version: 10.1.0   < 10.1.11-h4
Version: 10.2.0   < 10.2.7-h3
Version: 11.0.0   < 11.0.3

	Palo Alto Networks	Cloud NGFW
	Palo Alto Networks	Prisma Access	Version: 10.2 < 10.2.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-15T14:39:04.465851Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:32:48.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:12:06.617Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2024-3388"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PAN-OS",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "8.1.26",
                  "status": "unaffected"
                }
              ],
              "lessThan": "8.1.26",
              "status": "affected",
              "version": "8.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "9.0.17-h4",
                  "status": "unaffected"
                }
              ],
              "lessThan": "9.0.17-h4",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "9.1.17",
                  "status": "unaffected"
                }
              ],
              "lessThan": "9.1.17",
              "status": "affected",
              "version": "9.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "10.1.11-h4",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.1.11-h4",
              "status": "affected",
              "version": "10.1.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "10.2.7-h3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.2.7-h3",
              "status": "affected",
              "version": "10.2.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "11.0.3",
                  "status": "unaffected"
                }
              ],
              "lessThan": "11.0.3",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "11.1.0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Cloud NGFW",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Prisma Access",
          "vendor": "Palo Alto Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "10.2.4",
                  "status": "unaffected"
                }
              ],
              "lessThan": "10.2.4",
              "status": "affected",
              "version": "10.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue applies only to PAN-OS firewall configurations with an enabled GlobalProtect gateway and where you are permitting use of the SSL VPN either as a fallback or as the only available tunnel mode. You should verify whether you have a configured GlobalProtect gateway by checking for entries in your firewall web interface (Network \u003e GlobalProtect \u003e Gateways). You can also verify:\n- Whether SSL VPN fallback is permitted (check to see if the \"Disable Automatic Restoration of SSL VPN\" option is disabled in the GlobalProtect Gateway Configuration dialog by selecting Agent \u003e Connection Settings) or;\n- Whether SSL VPN is the only available tunnel mode (check to see if \"Enable IPSec\" is disabled (unchecked) in the GlobalProtect Gateway Configuration dialog by selecting Agent \u003e Tunnel Settings).\nBy default, both PAN-OS firewalls and Prisma Access use the SSL VPN only when the endpoint fails to successfully establish an IPSec tunnel."
            }
          ],
          "value": "This issue applies only to PAN-OS firewall configurations with an enabled GlobalProtect gateway and where you are permitting use of the SSL VPN either as a fallback or as the only available tunnel mode. You should verify whether you have a configured GlobalProtect gateway by checking for entries in your firewall web interface (Network \u003e GlobalProtect \u003e Gateways). You can also verify:\n- Whether SSL VPN fallback is permitted (check to see if the \"Disable Automatic Restoration of SSL VPN\" option is disabled in the GlobalProtect Gateway Configuration dialog by selecting Agent \u003e Connection Settings) or;\n- Whether SSL VPN is the only available tunnel mode (check to see if \"Enable IPSec\" is disabled (unchecked) in the GlobalProtect Gateway Configuration dialog by selecting Agent \u003e Tunnel Settings).\nBy default, both PAN-OS firewalls and Prisma Access use the SSL VPN only when the endpoint fails to successfully establish an IPSec tunnel."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Palo Alto Networks thanks Ta-Lun Yen of TXOne Networks for discovering and reporting this issue."
        }
      ],
      "datePublic": "2024-04-10T16:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets."
            }
          ],
          "value": "A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\u003cbr\u003e"
            }
          ],
          "value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-194",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-194 Fake the Source of Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-10T17:06:40.685Z",
        "orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
        "shortName": "palo_alto"
      },
      "references": [
        {
          "url": "https://security.paloaltonetworks.com/CVE-2024-3388"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in PAN-OS 8.1.26, PAN-OS 9.0.17-h4, PAN-OS 9.1.17, PAN-OS 10.1.11-h4, PAN-OS 10.2.7-h3, PAN-OS 11.0.3, and all later PAN-OS versions. This issue is fixed in Prisma Access 10.2.4 and later.\u003cbr\u003e"
            }
          ],
          "value": "This issue is fixed in PAN-OS 8.1.26, PAN-OS 9.0.17-h4, PAN-OS 9.1.17, PAN-OS 10.1.11-h4, PAN-OS 10.2.7-h3, PAN-OS 11.0.3, and all later PAN-OS versions. This issue is fixed in Prisma Access 10.2.4 and later.\n"
        }
      ],
      "source": {
        "defect": [
          "PAN-224964"
        ],
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-10T16:00:00.000Z",
          "value": "Initial publication"
        }
      ],
      "title": "PAN-OS: User Impersonation in GlobalProtect SSL VPN",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "You can enable the \"Disable Automatic Restoration of SSL VPN\" (Network \u003e GlobalProtect Gateways \u003e \u003cgateway-config\u003e \u003e GlobalProtect Gateway Configuration \u003e Agent \u003e Connection Settings) on PAN-OS firewalls with the GlobalProtect feature enabled to mitigate this vulnerability.\u003cbr\u003e"
            }
          ],
          "value": "You can enable the \"Disable Automatic Restoration of SSL VPN\" (Network \u003e GlobalProtect Gateways \u003e  \u003e GlobalProtect Gateway Configuration \u003e Agent \u003e Connection Settings) on PAN-OS firewalls with the GlobalProtect feature enabled to mitigate this vulnerability.\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
    "assignerShortName": "palo_alto",
    "cveId": "CVE-2024-3388",
    "datePublished": "2024-04-10T17:06:40.685Z",
    "dateReserved": "2024-04-05T17:40:20.687Z",
    "dateUpdated": "2024-08-01T20:12:06.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted