- 314/2024
- Critical
Palo Alto has released security updatesto fix multiple vulnerabilities affecting Palo Alto PAN-OS.
The addressed vulnerabilities could allow the attacker to gain elevated privileges, perform denial of service attacks, conduct SSRF attacks, obtain sensitive information, bypass security restrictions or gain access to the affected system.
Sample of the addressed vulnerabilities:
1. PAN-OS Authentication Bypass in The Management Web Interface Vulenrability (CVE-2024-0012):
- CVSS v4.0: 9.3
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Gain Privileges
2. PAN-OS Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet Vulnerability (CVE-2024-2550):
- CVSS v4.0: 6.6
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Denial of Service
Vulnerabilities
- CVE-2024-0012
- CVE-2024-9474
- CVE-2024-5920
- CVE-2024-2550
- CVE-2024-2551
- CVE-2024-2552
- CVE-2024-5917
- CVE-2024-5918
- CVE-2024-5919
- CVE-2024-9472
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.