PT-2024-2902 · Palo Alto Networks · Pan-Os

Rodgers Moore · Published 2024-04-10 · Updated 2024-04-10 · CVE-2024-3383

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions PAN-OS (affected versions not specified)

Description A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on existing Security Policy rules. The issue is related to insufficient access control, which can be exploited by a remote attacker to influence user access to network resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

CWE-282

Related Identifiers

BDU:2024-03067

CVE-2024-3383

Affected Products

Pan-Os

References · 8

• https://security.paloaltonetworks.com/CVE-2024-3383 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/706958 · Security Note
• https://bdu.fstec.ru/vul/2024-03067 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3383 · Security Note
• https://twitter.com/CVEnew/status/1778118911994540080 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2024041223 · Note
• https://twitter.com/VulmonFeeds/status/1778105977427898561 · Twitter Post