github - ghsa-wvjp-4x3w-pvqx

ghsa-wvjp-4x3w-pvqx

Vulnerability from github

Published

2024-04-10 18:30

Modified

2024-04-10 18:30

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Details

A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2024-3383",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-282",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2024-04-10T17:15:57Z",
      severity: "HIGH",
   },
   details: "A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.",
   id: "GHSA-wvjp-4x3w-pvqx",
   modified: "2024-04-10T18:30:48Z",
   published: "2024-04-10T18:30:48Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-3383",
      },
      {
         type: "WEB",
         url: "https://security.paloaltonetworks.com/CVE-2024-3383",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
         type: "CVSS_V3",
      },
   ],
}

cve-2024-3383

Vulnerability from cvelistv5

Published

2024-04-10 17:06

Modified

2024-08-09 20:22

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Summary

References

▼	URL	Tags
	https://security.paloaltonetworks.com/CVE-2024-3383

Impacted products

Vendor

Product

Version

▼

Palo Alto Networks

PAN-OS

Version: 11.0.0   < 11.0.3
Version: 10.2.0   < 10.2.5
Version: 10.1.0   < 10.1.11

	Palo Alto Networks	Cloud NGFW
	Palo Alto Networks	Prisma Access

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T20:12:06.566Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.paloaltonetworks.com/CVE-2024-3383",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-3383",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-08-09T20:22:10.488052Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-08-09T20:22:18.991Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "PAN-OS",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "11.1.0",
                  },
                  {
                     changes: [
                        {
                           at: "11.0.3",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "11.0.3",
                     status: "affected",
                     version: "11.0.0",
                     versionType: "custom",
                  },
                  {
                     changes: [
                        {
                           at: "10.2.5",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "10.2.5",
                     status: "affected",
                     version: "10.2.0",
                     versionType: "custom",
                  },
                  {
                     changes: [
                        {
                           at: "10.1.11",
                           status: "unaffected",
                        },
                     ],
                     lessThan: "10.1.11",
                     status: "affected",
                     version: "10.1.0",
                     versionType: "custom",
                  },
                  {
                     status: "unaffected",
                     version: "9.1.0",
                  },
                  {
                     status: "unaffected",
                     version: "9.0.0",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Cloud NGFW",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "All",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Prisma Access",
               vendor: "Palo Alto Networks",
               versions: [
                  {
                     status: "unaffected",
                     version: "All",
                  },
               ],
            },
         ],
         configurations: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "This issue applies only to PAN-OS firewall configurations with Cloud Identity Engine (CIE) enabled. You should verify whether CIE is configured on your firewall web interface (Device > User Identification > Cloud Identity Engine).",
                  },
               ],
               value: "This issue applies only to PAN-OS firewall configurations with Cloud Identity Engine (CIE) enabled. You should verify whether CIE is configured on your firewall web interface (Device > User Identification > Cloud Identity Engine).",
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Palo Alto Networks thanks Rodgers Moore, CCIE# 8153 of Insight.com, for discovering and reporting this issue.",
            },
         ],
         datePublic: "2024-04-10T16:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.",
                  },
               ],
               value: "A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.",
            },
         ],
         exploits: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Palo Alto Networks is not aware of any malicious exploitation of this issue.<br>",
                  },
               ],
               value: "Palo Alto Networks is not aware of any malicious exploitation of this issue.\n",
            },
         ],
         impacts: [
            {
               capecId: "CAPEC-271",
               descriptions: [
                  {
                     lang: "en",
                     value: "CAPEC-271 Schema Poisoning",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-282",
                     description: "CWE-282: Improper Ownership Management",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-04-10T17:06:15.823Z",
            orgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
            shortName: "palo_alto",
         },
         references: [
            {
               url: "https://security.paloaltonetworks.com/CVE-2024-3383",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "This issue is fixed in PAN-OS 10.1.11, PAN-OS 10.2.5, PAN-OS 11.0.3, and all later PAN-OS versions.<br>",
                  },
               ],
               value: "This issue is fixed in PAN-OS 10.1.11, PAN-OS 10.2.5, PAN-OS 11.0.3, and all later PAN-OS versions.\n",
            },
         ],
         source: {
            defect: [
               "PAN-211764",
               "PAN-218522",
            ],
            discovery: "USER",
         },
         timeline: [
            {
               lang: "en",
               time: "2024-04-10T16:00:00.000Z",
               value: "Initial publication",
            },
         ],
         title: "PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)",
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
      assignerShortName: "palo_alto",
      cveId: "CVE-2024-3383",
      datePublished: "2024-04-10T17:06:15.823Z",
      dateReserved: "2024-04-05T17:40:16.359Z",
      dateUpdated: "2024-08-09T20:22:18.991Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted