CVE-2024-8691 PAN-OS: User Impersonation in GlobalProtect Portal
Response Effort
MODERATE
Recovery
AUTOMATIC
Value Density
DIFFUSE
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Automatable
YES
User Interaction
NONE
Product Confidentiality
LOW
Product Integrity
LOW
Product Availability
LOW
Privileges Required
LOW
Subsequent Confidentiality
LOW
Subsequent Integrity
LOW
Subsequent Availability
LOW
Description
A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vulnerability are disconnected from GlobalProtect. Upon exploitation, PAN-OS logs indicate that the impersonated user authenticated to GlobalProtect, which hides the identity of the attacker.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 11.2 | None | All |
| PAN-OS 11.1 | None | All |
| PAN-OS 11.0 | None | All |
| PAN-OS 10.2 | None | All |
| PAN-OS 10.1 | < 10.1.11 | >= 10.1.11 |
| PAN-OS 9.1 | < 9.1.17 | >= 9.1.17 |
| Prisma Access | None | All |
Severity: MEDIUM, Suggested Urgency: MODERATE
CVSS-B: 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y/R:A/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type
CWE-863 Incorrect Authorization
Solution
This issue is fixed in PAN-OS 9.1.17, PAN-OS 10.1.11, and all later PAN-OS versions.
Acknowledgments
Palo Alto Networks thanks Claudiu Pancotan for discovering and reporting this issue.
Timeline
Initial publication