Unrated severityNVD Advisory· Published Nov 14, 2024· Updated Nov 14, 2024

PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

CVE-2024-5919

Description

A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.

Affected products

Paloaltonetworks/Pan Osv52 versions
cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h4:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:paloaltonetworks:pan-os:11.0.1:h4:*:*:*:*:*:*range: 11.0.0
- (no CPE)
Paloaltonetworks/Cloud NGFWcpe-rescue
Range: All
Paloaltonetworks/Prisma Access Agentcpe-rescue
Range: All

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

security.paloaltonetworks.com/CVE-2024-5919mitrevendor-advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000