PT-2024-8350 · Palo Alto Networks · Pan-Os

Kajetan Rostojek · Published 2024-11-13 · Updated 2025-05-01 · CVE-2024-5920

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Palo Alto Networks PAN-OS software is affected by a cross-site scripting (XSS) issue, which allows an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator, who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate administrator's browser. An exploit for this issue is available, with more information accessible at https://t.co/tF8CkcjpgX and https://t.co/RlZWNQvLLs. Unfortunately, the specific versions of the vulnerable software are not mentioned in the provided text. #PaloAltoNetworks #PANOS #XSS #CrossSiteScripting #AuthenticatedXSS #PANOSsoftware #NetworkSecurity #CyberSecurity

Fix

XSS

Weakness Enumeration

CWE-592

CWE-79

Related Identifiers

BDU:2024-09906

CVE-2024-5920

Affected Products

Pan-Os

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-5920 · Security Note
• https://security.paloaltonetworks.com/CVE-2024-5920 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09906 · Security Note
• https://osv.dev/vulnerability/CVE-2024-5920 · Vendor Advisory
• https://t.me/cvedetector/10911 · Telegram Post
• https://twitter.com/SystemTek_UK/status/1857539741450674482 · Twitter Post
• https://t.me/cvenotify/108500 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857069322050420908 · Twitter Post
• https://twitter.com/CVEnew/status/1857065015074799839 · Twitter Post
• https://twitter.com/RedPacketSec/status/1917884055061680561 · Twitter Post
• https://twitter.com/RedPacketSec/status/1917884053795000375 · Twitter Post
• https://twitter.com/RedPacketSec/status/1917884052549271962 · Twitter Post
• https://twitter.com/RedPacketSec/status/1917884051253248195 · Twitter Post
• https://reddit.com/r/paloaltonetworks/comments/1itykg5/palo_alto_bad_documentation · Reddit Post