PT-2024-8352 · Palo Alto Networks · Pan-Os

Bobby Storey · Published 2024-11-13 · Updated 2025-01-24 · CVE-2024-2552

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS (affected versions not specified)

Description A command injection issue in the software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall. The vulnerability is also related to incorrect restriction of a directory path name with limited access, which can allow an attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-09908

CVE-2024-2552

Affected Products

Pan-Os

References · 11

• https://security.paloaltonetworks.com/CVE-2024-2552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2552 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-2550 · Security Note
• https://bdu.fstec.ru/vul/2024-09908 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2552 · Vendor Advisory
• https://twitter.com/CVEnew/status/1857065018069557564 · Twitter Post
• https://t.me/cvenotify/108497 · Telegram Post
• https://t.me/cvedetector/10925 · Telegram Post
• https://t.me/cvenotify/101651 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857087244282007948 · Twitter Post
• https://security.paloaltonetworks.com/CVE-2024-2550 · Note