« Volver al listado

CVE-2024-5917

Estado: AnalizadaBaja (2.1)—

A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Paloaltonetworks — Pan-os

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-5917",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-5917",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-14T18:58:18.463866Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@paloaltonetworks.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "AUTOMATIC",
          "baseScore": 2.1,
          "Automatable": "NO",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "AMBER",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "Palo Alto Networks",
          "product": "Cloud NGFW",
          "versions": [
            {
              "status": "unaffected",
              "version": "All"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Palo Alto Networks",
          "product": "PAN-OS",
          "versions": [
            {
              "status": "unaffected",
              "version": "11.2.0"
            },
            {
              "status": "unaffected",
              "version": "11.1.0"
            },
            {
              "status": "unaffected",
              "version": "11.0.0"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "10.2.2",
                  "status": "unaffected"
                }
              ],
              "version": "10.2.0",
              "lessThan": "10.2.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "10.1.7",
                  "status": "unaffected"
                }
              ],
              "version": "10.1.0",
              "lessThan": "10.1.7",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:paloaltonetworks:cloud_ngfw:*:*:*:*:*:*:*:*"
          ],
          "vendor": "paloaltonetworks",
          "product": "cloud_ngfw",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "*",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:paloaltonetworks:pan-os:11.2.0:*:*:*:*:*:*:*"
          ],
          "vendor": "paloaltonetworks",
          "product": "pan-os",
          "versions": [
            {
              "status": "affected",
              "version": "11.2.0"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:paloaltonetworks:pan-os:11.1.0:*:*:*:*:*:*:*"
          ],
          "vendor": "paloaltonetworks",
          "product": "pan-os",
          "versions": [
            {
              "status": "affected",
              "version": "11.1.0"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:paloaltonetworks:pan-os:11.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "paloaltonetworks",
          "product": "pan-os",
          "versions": [
            {
              "status": "affected",
              "version": "11.0.0"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*"
          ],
          "vendor": "paloaltonetworks",
          "product": "pan-os",
          "versions": [
            {
              "status": "affected",
              "version": "10.2.0",
              "lessThan": "10.2.2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.1.0",
              "lessThan": "10.1.7",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-14T10:15:08.607",
  "references": [
    {
      "url": "https://security.paloaltonetworks.com/CVE-2024-5917",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@paloaltonetworks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible."
    },
    {
      "lang": "es",
      "value": "Server-side request forgeryen el software PAN-OS permite a un atacante no autenticado utilizar la interfaz web administrativa como proxy, lo que le permite ver recursos de red internos que de otra manera no serían accesibles."
    }
  ],
  "lastModified": "2026-06-17T08:16:54.543",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98999D32-B8D9-4D47-94D9-6383D31D0518",
              "versionEndExcluding": "10.1.7",
              "versionStartIncluding": "10.1.0"
            },
            {
              "criteria": "cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22513B1B-6022-4732-8CD4-6E74E40D664A",
              "versionEndExcluding": "10.2.2",
              "versionStartIncluding": "10.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}