CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
En bref
- Source
- NVD
- EPSS
- EPSS 100.00 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- palo_alto
- Statut NVD
- Analyzed
Description
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Faiblesses (CWE)
Références
- https://security.paloaltonetworks.com/CVE-2024-3400
- https://unit42.paloaltonetworks.com/cve-2024-3400/
- https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
- https://www.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-3400
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | palo_alto |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-31989
- GCVE · GCVE-0-2024-3400
Avis du CERT-FR
- CERTFR-2024-AVI-0338 — Vulnérabilité dans Siemens RUGGEDCOM APE1808 · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0307 — Vulnérabilité dans Palo Alto Networks GlobalProtect · cert.ssi.gouv.fr
- CERTFR-2024-ALE-006 — [Mà J] Vulnérabilité dans Palo Alto Networks GlobalProtect · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.1:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.2:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h11:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h12:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.3:h9:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h10:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.4:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.5:h4:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.6:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.8:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:10.2.9:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h2:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h3:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:-:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h1:*:*:*:*:*:*cpe:2.3:o:paloaltonetworks:pan-os:11.0.2:h2:*:*:*:*:*:*- +12 autres
Produits affectés
| Produit | Versions |
|---|---|
| Palo Alto Networks · PAN-OS | unaffected 9.0.0 ; unaffected 9.1.0 ; unaffected 10.0.0 ; unaffected 10.1.0 ; affected 10.2.0 < 10.2.9-h1 ; affected 11.0.0 < 11.0.4-h1 |
| Palo Alto Networks · Cloud NGFW | unaffected All |
| Palo Alto Networks · Prisma Access | unaffected All |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |