CVE-2024-2433

PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss

State: Published
Severity: 4.3 Medium
Published: Mar 13, 2024
Updated: May 13, 2026
Reserved: Mar 13, 2024

Description

An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web interface and completely fill one of the disk partitions with those uploaded files, which prevents the ability to log into the web interface or to download PAN-OS, WildFire, and content images.

This issue affects only the web interface of the management plane; the dataplane is unaffected.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	palo_alto

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	9.0 to before 9.0.17-h4Affectedfrom 9.0.17-h4Not affected 9.1 to before 9.1.17Affectedfrom 9.1.17Not affected 10.1 to before 10.1.12Affectedfrom 10.1.12Not affected 10.2 to before 10.2.8Affectedfrom 10.2.8Not affected 11.0 to before 11.0.3Affectedfrom 11.0.3Not affected 11.1Not affected
Cloud NGFWPalo Alto Networks	AllNot affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2024-2433

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.