CVE-2024-8687
PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes
MEDIUM 6.9
En bref
- Source
- NVD
- EPSS
- EPSS 0.41 % · centile 35 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- palo_alto
- Statut NVD
- Analyzed
Description
An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.
Faiblesses (CWE)
- CWE-497 — Exposition d'informations système sensibles à une sphère non autorisée
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amber | palo_alto |
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber | NVD · psirt@paloaltonetworks.com (Secondary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-49346
- GCVE · GCVE-0-2024-8687
Avis du CERT-FR
- CERTFR-2024-AVI-0770 — Multiples vulnérabilités dans les produits Palo Alto Networks · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 8.1.0 < 8.1.25cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.0.17cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 9.1.0 < 9.1.16cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.0.12cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.1.0 < 10.1.9cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*≥ 10.2.0 < 10.2.4cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:*:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*≥ 5.1.0 < 5.1.12cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*≥ 5.2.0 < 5.2.13cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.7cpe:2.3:a:paloaltonetworks:globalprotect:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.1.2cpe:2.3:a:paloaltonetworks:globalprotect:6.2.0:*:*:*:*:*:*:*cpe:2.3:a:paloaltonetworks:prisma_access:-:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Palo Alto Networks · PAN-OS | unaffected 11.1.0 ; unaffected 11.2.0 ; affected 11.0.0 < 11.0.1 ; affected 10.2.0 < 10.2.4 ; affected 10.1.0 < 10.1.9 ; affected 10.0.0 < 10.0.12 |
| Palo Alto Networks · GlobalProtect App | affected 5.1.0 < 5.1.12 ; affected 5.2.0 < 5.2.13 ; affected 6.0.0 < 6.0.7 ; affected 6.1.0 < 6.1.2 ; affected 6.2.0 < 6.2.1 ; unaffected 6.3.0 |
| Palo Alto Networks · Cloud NGFW | unaffected All |
| Palo Alto Networks · Prisma Access | affected 10.2.0 < 10.2.9 on PAN-OS |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |