CVE-2024-5919

A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - psirt@paloaltonetworks.com

Published

2024-11-14

Last modified

2024-11-14

Weaknesses

CWE-611

Affected products

• Cloud Ngfw (Palo Alto Networks)
• Prisma Access (Palo Alto Networks)
• Pan-os (Paloaltonetworks)

References

• https://security.paloaltonetworks.com/CVE-2024-5919