VDB

CVE-2024-5911

CVE-2024-5911 PUBLISHED CVSS 7 HIGH

PAN-OS: File Upload Vulnerability in the Panorama Web Interface

Reported by palo_alto · Published July 10, 2024

An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interface to disrupt system processes and crash the Panorama. Repeated attacks eventually cause the Panorama to enter maintenance mode, which requires manual intervention to bring the Panorama back online.

Risk scores

CVSS 4.0
7
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber

Affected products

VendorProductVersions
Palo Alto NetworksPAN-OS11.2, 11.1, 11.0
Palo Alto NetworksCloud NGFWAll
Palo Alto NetworksPrisma AccessAll
Palo Alto NetworksPAN-OS11.0, 10.1.0, 11.2
Palo Alto NetworksPrisma Access*
Palo Alto NetworksCloud NGFW*

Timeline

  • Jul 10, 2024 CVE Published
  • Jul 11, 2024 EPSS Score (30 in total, the first dated here)
  • Jul 12, 2024 PoC Published
  • Aug 1, 2024 CVE Updated
  • Oct 5, 2024 Coalition ESS Score (9 in total, the first dated here)
  • Jun 2, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2024-5911
vulnetix vdb fixes CVE-2024-5911

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-5911/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

  • vendor-advisory
Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›