Skip to content
OpenAdvisories
Medium WID-SEC-2024-0394 5 CVEs

PaloAlto Networks PAN-OS: Mehrere Schwachstellen

Published Feb 14, 2024 · Updated Feb 14, 2024 · de-DE

Vendor: Palo Alto Networks Product: PAN-OS

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in PaloAlto Networks PAN-OS ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten oder um Sicherheitsmaßnahmen zu umgehen.

Product

PAN-OS ist das Betriebssystem der Sicherheitssysteme / Firewalls der Firma Palo Alto Networks.

Vulnerabilities 5

  • Medium 6.8
    CVE-2024-0007

    PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface

    A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScript payload using the web interface on Panorama appliances. This enables the impersonation of another…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 6.6
    CVE-2024-0008

    PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface

    Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 6.3
    CVE-2024-0009

    PAN-OS: Improper IP Address Verification in GlobalProtect Gateway

    An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.3
    CVE-2024-0010

    PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal

    A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of a user’s browser) if a user clicks on a malicious link, allowing phishi…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.3
    CVE-2024-0011

    PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication

    A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context of an authenticated Captive Portal user’s browser) if a user clicks on a malicio…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices

Revision history

  1. #1

    Initiale Fassung

References