What is CVE-2024-5920?

CVE-2024-5920 is a security advisory published by Palo Alto Networks Security Advisories with Low severity. CVE-2024-5920 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator

Which CVE IDs does CVE-2024-5920 cover?

CVE-2024-5920 covers the following CVE IDs: CVE-2024-5920. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2024-5920?

CVE-2024-5920 affects 3 products, including: Cloud NGFW; PAN-OS; Prisma Access.

CVE-2024-5920Low

CVE-2024-5920 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator

Vendor

Palo Alto Networks Security Advisories

Published

November 13, 2024

Last Modified

April 30, 2025

🔗 CVE IDs covered (1)

CVE-2024-5920 →

📋 Description

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate PAN-OS administrator's browser.

🎯 Affected products3

Cloud NGFW
PAN-OS
Prisma Access

✅ Remediation

This issue is fixed in PAN-OS 10.1.14, 10.2.10-h14, PAN-OS 10.2.11, PAN-OS 11.0.6, PAN-OS 11.1.4, and all later PAN-OS versions. Workarounds and mitigations: No known workarounds or mitigations exist for this issue.

🔗 References (1)

advisoryhttps://security.paloaltonetworks.com/CVE-2024-5920