Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2024-8691

PAN-OS: User Impersonation in GlobalProtect Portal

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vulnerability are disconnected from GlobalProtect. Upon exploitation, PAN-OS logs indicate that the impersonated user authenticated to GlobalProtect, which hides the identity of the attacker.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks PAN-OS

Default version status: unaffected

  • 9.1.0 to < 9.1.17affected
  • 10.1.0 to < 10.1.11affected
  • 10.2.0unaffected
  • 11.0.0unaffected
  • 11.1.0unaffected
  • 11.2.0unaffected

Palo Alto Networks Cloud NGFW

Default version status: unaffected

  • Allunaffected

Palo Alto Networks Prisma Access

Default version status: unaffected

  • Allunaffected

References