CVE-2024-5919Low

CVE-2024-5919 PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability

Published
November 13, 2024
Last Modified
November 13, 2024

🔗 CVE IDs covered (1)

CVE-2024-5919 →

📋 Description

A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.

🎯 Affected products3

  • Cloud NGFW
  • PAN-OS
  • Prisma Access

✅ Remediation

This issue is fixed in PAN-OS 10.1.10, PAN-OS 10.2.5, PAN-OS 11.0.2, and all later PAN-OS versions. Workarounds and mitigations: TBD

🔗 References (1)