CVE-2024-5918 | THREATINT

Description

An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you "Allow Authentication with User Credentials OR Client Certificate."

Reserved 2024-06-12 | Published 2024-11-14 | Updated 2024-11-14 | Assigner palo_alto

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/AU:N/R:A/V:C/RE:M/U:Amber

Problem types

CWE-295 Improper Certificate Validation

Product status

Default status

unaffected

All

unaffected

Default status

unaffected

11.2.0

unaffected

11.1.0

unaffected

11.0.0 before 11.0.3

affected

10.2.0 before 10.2.4-h5

affected

10.1.0 before 10.1.11

affected

Default status

unaffected

All

unaffected

Timeline

2024-11-13:

Initial publication

References

security.paloaltonetworks.com/CVE-2024-5918 vendor-advisory

cve.org (CVE-2024-5918)

nvd.nist.gov (CVE-2024-5918)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.