CVE-2024-5911

PAN-OS: File Upload Vulnerability in the Panorama Web Interface

State: Published
Severity: 7.0 High
Published: Jul 10, 2024
Updated: Aug 1, 2024
Reserved: Jun 12, 2024

Description

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which requires manual intervention to bring the Panorama back online.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber	palo_alto

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
PAN-OSPalo Alto Networks	11.2Not affected 11.1Not affected 11.0Not affected 10.2.0 to before 10.2.4Affectedfrom 10.2.4Not affected 10.1.0 to before 10.1.9Affectedfrom 10.1.9Not affected
Cloud NGFWPalo Alto Networks	AllNot affected
Prisma AccessPalo Alto Networks	AllNot affected

References

https://security.paloaltonetworks.com/CVE-2024-5911vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.