CVE-2024-2433

Summary

An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images.

This issue affects only the web interface of the management plane; the dataplane is unaffected.

Affected Software

VendorProductVersion RangeStatus
Palo Alto NetworksPAN-OS9.0 < 9.0.17-h4affected
Palo Alto NetworksPAN-OS9.1 < 9.1.17affected
Palo Alto NetworksPAN-OS10.1 < 10.1.12affected
Palo Alto NetworksPAN-OS10.2 < 10.2.8affected
Palo Alto NetworksPAN-OS11.0 < 11.0.3affected
Palo Alto NetworksPAN-OS11.1unaffected
Palo Alto NetworksCloud NGFWAllunaffected
Palo Alto NetworksPrisma AccessAllunaffected

Weaknesses

  • CWE-269: CWE-269 Improper Privilege Management

Workarounds

This issue requires the attacker to have authenticated access to the PAN-OS web interface. You can mitigate the effect of this issue by following the Best Practices for Securing Administrative Access in the PAN-OS technical documentation at https://docs.paloaltonetworks.com/best-practices .

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References