CVEvulnerability

CVE-2024-3388

5.0 MEDIUM Published 2024-04-10 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-04-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weaknesses
CWE-269, CWE-863

Description

A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.

Affected configurations

• paloaltonetworks pan-os (>= 8.1.0 < 8.1.26) • paloaltonetworks pan-os (>= 9.0.0 < 9.0.17) • paloaltonetworks pan-os (>= 9.1.0 < 9.1.17) • paloaltonetworks pan-os (>= 10.1.0 < 10.1.11) • paloaltonetworks pan-os (>= 10.2.0 < 10.2.7) • paloaltonetworks pan-os (>= 11.0.0 < 11.0.3) • paloaltonetworks pan-os 9.0.17 • paloaltonetworks pan-os 10.1.11 • paloaltonetworks pan-os 10.2.7 • paloaltonetworks prisma access

Related

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-863 Incorrect Authorization weakness

References