nvd.nist.gov Open in urlscan Pro
2600:1f18:268d:1ddd:fd96:dcaa:cf17:f2b2  Public Scan

Form analysis
0 forms found in the DOM

Text Content

YOU ARE VIEWING THIS PAGE IN AN UNAUTHORIZED FRAME WINDOW.

This is a potential security issue, you are being redirected to
https://nvd.nist.gov

You have JavaScript disabled. This site requires JavaScript to be enabled for
complete site functionality.

  An official website of the United States government Here's how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.

Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share
sensitive information only on official, secure websites.

NVD MENU
 * General Expand or Collapse
   
   NVD Dashboard
   
   News and Status Updates
   
   FAQ
   
   Visualizations
   
   Legal Disclaimer

 * Vulnerabilities Expand or Collapse
   
   Search & Statistics
   
   Weakness Types
   
   Legacy Data Feeds
   
   Vendor Comments
   
   CVMAP

 * Vulnerability Metrics Expand or Collapse
   
   CVSS v4.0 Calculators
   
   CVSS v3.x Calculators
   
   CVSS v2.0 Calculator

 * Products Expand or Collapse
   
   CPE Dictionary
   
   CPE Search
   
   CPE Statistics
   
   SWID
   
   
 * Developers Expand or Collapse
   
   Start Here
   
   Request an API Key
   
   Vulnerabilities
   
   Products
   
   Data Sources
   
   Terms of Use

 * Contact NVD
 * Other Sites Expand or Collapse
   
   Checklist (NCP) Repository
   
   Configurations (CCE)
   
   800-53 Controls
   
   SCAP Validated Tools
   
   SCAP
   
   USGCB

 * Search Expand or Collapse
   
   Vulnerability Search
   
   CPE Search


INFORMATION TECHNOLOGY LABORATORY


NATIONAL VULNERABILITY DATABASE


NATIONAL VULNERABILITY DATABASE


NVD


 1. Vulnerabilities


CVE-2024-0012 DETAIL


DESCRIPTION

An authentication bypass in Palo Alto Networks PAN-OS software enables an
unauthenticated attacker with network access to the management web interface to
gain PAN-OS administrator privileges to perform administrative actions, tamper
with the configuration, or exploit other authenticated privilege escalation
vulnerabilities like CVE-2024-9474
https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is
greatly reduced if you secure access to the management web interface by
restricting access to only trusted internal IP addresses according to our
recommended  best practice deployment guidelines
https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431
. This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and
PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this
vulnerability.



METRICS

 
CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:


NIST: NVD
N/A
NVD assessment not yet provided.


CNA:  Palo Alto Networks, Inc.
CVSS-B 9.3 CRITICAL
Vector: 
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AU:N/R:U/V:C/RE:H/U:Red
CVSS 3.x Severity and Vector Strings:


NIST: NVD
Base Score:  9.8 CRITICAL
Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 Severity and Vector Strings:


NIST: NVD
Base Score: N/A
NVD assessment not yet provided.


REFERENCES TO ADVISORIES, SOLUTIONS, AND TOOLS

By selecting these links, you will be leaving NIST webspace. We have provided
these links to other web sites because they may have information that would be
of interest to you. No inferences should be drawn on account of other sites
being referenced, or not, from this page. There may be other web sites that are
more appropriate for your purpose. NIST does not necessarily endorse the views
expressed, or concur with the facts presented on these sites. Further, NIST does
not endorse any commercial products that may be mentioned on these sites. Please
address comments about this page to nvd@nist.gov.

Hyperlink Resource https://security.paloaltonetworks.com/CVE-2024-0012 Vendor
Advisory 


THIS CVE IS IN CISA'S KNOWN EXPLOITED VULNERABILITIES CATALOG

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for
further guidance and requirements.

Vulnerability Name Date Added Due Date Required Action Palo Alto Networks PAN-OS
Management Interface Authentication Bypass Vulnerability 11/18/2024 12/09/2024
Apply mitigations per vendor instructions or discontinue use of the product if
mitigations are unavailable. Additionally, management interface for affected
devices should not be exposed to untrusted networks, including the internet.


WEAKNESS ENUMERATION

CWE-ID CWE Name Source CWE-306 Missing Authentication for Critical Function
NIST   Palo Alto Networks, Inc.  


KNOWN AFFECTED SOFTWARE CONFIGURATIONS SWITCH TO CPE 2.2


CPES LOADING, PLEASE WAIT.

Configuration 1 ( hide )


 cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
   Show Matching CPE(s) From (including)
10.2.0Up to (excluding)
10.2.12  cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*
   Show Matching CPE(s)
 cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*
   Show Matching CPE(s)  cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
   Show Matching CPE(s) From (including)
11.0.0Up to (excluding)
11.0.6  cpe:2.3:o:paloaltonetworks:pan-os:11.0.6:-:*:*:*:*:*:*
   Show Matching CPE(s)  cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
   Show Matching CPE(s) From (including)
11.1.0Up to (excluding)
11.1.5  cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:-:*:*:*:*:*:*
   Show Matching CPE(s)  cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*
   Show Matching CPE(s) From (including)
11.2.0Up to (excluding)
11.2.4  cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*
   Show Matching CPE(s)


Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.



CHANGE HISTORY

3 change records found show changes

INITIAL ANALYSIS BY NIST 11/19/2024 12:17:29 PM

Action Type Old Value New Value Added CVSS V3.1

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H



Added CWE

NIST CWE-306



Added CPE Configuration Record truncated, showing 500 of 767 characters.
View Entire Change Record


OR
     *cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* versions from (including) 10.2.0 up to (excluding) 10.2.12
     *cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:-:*:*:*:*:*:*
     *cpe:2.3:o:paloaltonetworks:pan-os:10.2.12:h1:*:*:*:*:*:*
     *cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* versions from (including) 11.0.0 up to (excluding) 11.0.6
     *cpe:2.3:o:paloaltonetworks:pan-os:11.0.6:-:*:*:*:*:*:*
     *cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* versions from (including) 

Changed Reference Type

https://security.paloaltonetworks.com/CVE-2024-0012 No Types Assigned



https://security.paloaltonetworks.com/CVE-2024-0012 Vendor Advisory



CVE CISA KEV UPDATE BY CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA)
U.S. CIVILIAN GOVERNMENT 11/18/2024 9:00:02 PM

Action Type Old Value New Value Added Date Added

2024-11-18



Added Due Date

2024-12-09



Added Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.



Added Vulnerability Name

Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability



NEW CVE RECEIVED FROM PALO ALTO NETWORKS, INC. 11/18/2024 11:15:11 AM

Action Type Old Value New Value Added Description Record truncated, showing 500
of 921 characters.
View Entire Change Record


An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like  CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 .

The risk of this issue is greatly reduced if you secure access to the management web interface by re

Added CVSS V4.0

Palo Alto Networks, Inc. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red



Added CWE

Palo Alto Networks, Inc. CWE-306



Added Reference

Palo Alto Networks, Inc. https://security.paloaltonetworks.com/CVE-2024-0012 [No types assigned]



QUICK INFO

CVE Dictionary Entry:
CVE-2024-0012
NVD Published Date:
11/18/2024
NVD Last Modified:
11/19/2024
Source:
Palo Alto Networks, Inc.


 * twitter (link is external)
 * facebook (link is external)
 * linkedin (link is external)
 * youtube (link is external)
 * rss
 * govdelivery (link is external)


HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
(301) 975-2000

Webmaster | Contact Us | Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email: soc@us-cert.gov
Phone: 1-888-282-0870

Site Privacy | Accessibility | Privacy Program | Copyrights | Vulnerability
Disclosure | No Fear Act Policy | FOIA | Environmental Policy | Scientific
Integrity | Information Quality Standards | Commerce.gov | Science.gov | USA.gov