CVE-2024-3388
Last modified
CVE-2024-3388 is a medium-severity vulnerability rated 5/10 on the CVSS scale. A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Paloaltonetworks | Pan-Os | >= 8.1.0, < 8.1.26 |
| Paloaltonetworks | Pan-Os | >= 9.0.0, < 9.0.17 |
| Paloaltonetworks | Pan-Os | >= 9.1.0, < 9.1.17 |
| Paloaltonetworks | Pan-Os | >= 10.1.0, < 10.1.11 |
| Paloaltonetworks | Pan-Os | >= 10.2.0, < 10.2.7 |
| Paloaltonetworks | Pan-Os | >= 11.0.0, < 11.0.3 |
| Paloaltonetworks | Pan-Os | 9.0.17 |
| Paloaltonetworks | Pan-Os | 10.1.11 |
| Paloaltonetworks | Pan-Os | 10.2.7 |
| Paloaltonetworks | Prisma Access | All versions |
References
- https://security.paloaltonetworks.com/CVE-2024-3388Vendor Advisory
- https://security.paloaltonetworks.com/CVE-2024-3388Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-3388?
How severe is CVE-2024-3388?
How do I fix CVE-2024-3388?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-33874HDF5 Library through 1.14.3 has a heap buffer overflow in H5…9.8
- CVE-2024-33875HDF5 Library through 1.14.3 has a heap-based buffer overflow…5.7
- CVE-2024-33876HDF5 Library through 1.14.3 has a heap buffer overflow in H5…5.7
- CVE-2024-33877HDF5 Library through 1.14.3 has a heap-based buffer overflow…8.8
- CVE-2024-33878Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2024-33879An issue was discovered in VirtoSoftware Virto Bulk File Dow…9.8
- CVE-2024-33880An issue was discovered in VirtoSoftware Virto Bulk File Dow…5.3
- CVE-2024-33881An issue was discovered in VirtoSoftware Virto Bulk File Dow…5.3
- CVE-2024-33883The ejs (aka Embedded JavaScript templates) package before 3…4
- CVE-2024-33891Delinea Secret Server before 11.7.000001 allows attackers to…8.8
- CVE-2024-33892Insecure Permissions vulnerability in Cosy+ devices running …7.5
- CVE-2024-33893Cosy+ devices running a firmware 21.x below 21.2s10 or a fir…6.1
Are you affected by CVE-2024-3388?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST