CVE-2024-5919 | THREATINT

Description

A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.

Reserved 2024-06-12 | Published 2024-11-14 | Updated 2024-11-14 | Assigner palo_alto

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:C/RE:M/U:Amber

Problem types

CWE-611 Improper Restriction of XML External Entity Reference

Product status

Default status

unaffected

All

unaffected

Default status

unaffected

11.2.0

unaffected

11.1.0

unaffected

11.0.0 before 11.0.2

affected

10.2.0 before 10.2.5

affected

10.1.0 before 10.1.10

affected

Default status

unaffected

All

unaffected

Timeline

2024-11-13:

Initial publication

Credits

Dan Marin of Deloitte finder

Cristian Mocanu of Deloitte finder

Alex Hordijk finder

References

security.paloaltonetworks.com/CVE-2024-5919 vendor-advisory

cve.org (CVE-2024-5919)

nvd.nist.gov (CVE-2024-5919)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.