CVE-2023-38046

PAN-OS: Read System Files and Resources During Configuration Commit

State: Published
Severity: 5.5 Medium
Published: Jul 12, 2023
Updated: Feb 10, 2025
Reserved: Jul 12, 2023

Description

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N	palo_alto

Weaknesses

CWE-610 Externally Controlled Reference to a Resource in Another Sphere

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	11.0 to before 11.0.1Affectedfrom 11.0.1Not affected 10.2 to before 10.2.4Affectedfrom 10.2.4Not affected 10.1Not affected 10.0Not affected 9.1Not affected 9.0Not affected 8.1Not affected
Cloud NGFWPalo Alto Networks	AllNot affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2023-38046

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.