Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2024-5919

PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks Cloud NGFW

Default version status: unaffected

  • Allunaffected

Palo Alto Networks PAN-OS

Default version status: unaffected

  • 11.2.0unaffected
  • 11.1.0unaffected
  • 11.0.0 to < 11.0.2affected
  • 10.2.0 to < 10.2.5affected
  • 10.1.0 to < 10.1.10affected

Palo Alto Networks Prisma Access

Default version status: unaffected

  • Allunaffected

References