Palo Alto Security Updates – 15 February 2024

By /
  • 58/2024
  • Medium

Palo Alto has released security updates to address several vulnerabilities affecting multiple PAN-OS versions.

The addressed vulnerabilities could allow the attacker to perform cross-site scripting (XSS) attacks, bypass security restrictions, or execute arbitrary code, and gain access to the affected products.

Sample of the addressed vulnerabilities:

1. PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface (CVE-2024-0007):

  • CVSS: 6.3
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: Required
  • Consequences: Cross-Site Scripting

2. PAN-OS: Improper IP Address Verification in GlobalProtect Gateway Vulnerability (CVE-2024-0009):

  • CVSS: 5.3
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Gain Access
Vulnerabilities
  • CVE-2024-0007
  • CVE-2024-0008
  • CVE-2024-0009
  • CVE-2024-0010
  • CVE-2024-0011
Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.

Palo Alto Security Advisory

References

Palo Alto Security Advisory