Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2024-9471

PAN-OS: Privilege Escalation (PE) Vulnerability in XML API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
palo_alto

Description

A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system administrator" to perform write operations on the virtual system configuration even though they should be limited to read-only operations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Palo Alto Networks PAN-OS

Default version status: unaffected

  • 11.1.0unaffected
  • 11.0.0 to < 11.0.3affected
  • 10.1.0 to < 10.1.11affected
  • 10.2.0 to < 10.2.8affected
  • 9.1affected
  • 9.0affected

Palo Alto Networks Cloud NGFW

Default version status: unaffected

  • Allunaffected

Palo Alto Networks Prisma Access

Default version status: unaffected

  • Allunaffected

References