7.1

CVE-2024-8687

An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the GlobalProtect app configuration would not normally permit them to do so.

Data is provided by the National Vulnerability Database (NVD)
Paloaltonetworks ≫ Pan-os Version >= 8.1.0 < 8.1.25
Paloaltonetworks ≫ Pan-os Version >= 9.0.0 < 9.0.17
Paloaltonetworks ≫ Pan-os Version >= 9.1.0 < 9.1.16
Paloaltonetworks ≫ Pan-os Version >= 10.0.0 < 10.0.12
Paloaltonetworks ≫ Pan-os Version >= 10.1.0 < 10.1.9
Paloaltonetworks ≫ Pan-os Version >= 10.2.0 < 10.2.4
Paloaltonetworks ≫ Pan-os Version11.0.0
Paloaltonetworks ≫ Globalprotect Version >= 5.1.0 < 5.1.12
Paloaltonetworks ≫ Globalprotect Version >= 5.2.0 < 5.2.13
Paloaltonetworks ≫ Globalprotect Version >= 6.0.0 < 6.0.7
Paloaltonetworks ≫ Globalprotect Version >= 6.1.0 < 6.1.2
Paloaltonetworks ≫ Globalprotect Version6.2.0
Paloaltonetworks ≫ Prisma Access Version-
   Paloaltonetworks ≫ Pan-os Version < 10.2.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.06% 0.189
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
psirt@paloaltonetworks.com 6.9 0 0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.