CVE-2024-5918: PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User (Severity: LOW)

Q: What is the severity of CVE-2024-5918?

CVE-2024-5918 is classified as a high severity vulnerability due to its potential impact on user authentication.

Q: How do I fix CVE-2024-5918?

To fix CVE-2024-5918, update your PAN-OS software to version 11.0.4 or later, 10.2.5-h5, or 10.1.12.

Q: What systems are affected by CVE-2024-5918?

CVE-2024-5918 affects Palo Alto Networks PAN-OS, Cloud NGFW, and Prisma Access if running specified vulnerable versions.

Q: What is the impact of exploiting CVE-2024-5918?

Exploitation of CVE-2024-5918 allows an unauthorized user to impersonate legitimate users by using a specially crafted client certificate.

Q: Who should be concerned about CVE-2024-5918?

Organizations using affected Palo Alto Networks products should prioritize addressing CVE-2024-5918 to protect user authentication integrity.

Published Nov 13, 2024

Updated

An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you "Allow Authentication with User Credentials OR Client Certificate."

Affected Software

10 affected componentsFixes available

Palo Alto Networks Cloud NGFW

Palo Alto Networks PAN-OS<11.0.3, =11.0.0, <10.2.4-h5, =10.2.0, <10.1.11, =10.1.0

11.0.310.2.4-h510.1.11

Palo Alto Networks Prisma Access

Palo Alto Networks PAN-OS>=10.1.0<10.1.11

Palo Alto Networks PAN-OS>=10.2.0<=10.2.4

Palo Alto Networks PAN-OS>=11.0.0<11.0.3

Palo Alto Networks PAN-OS=10.2.4

Palo Alto Networks PAN-OS=10.2.4-h2

Palo Alto Networks PAN-OS=10.2.4-h3

Palo Alto Networks PAN-OS=10.2.4-h4

Remediation

Mitigation

You can mitigate this issue by setting the "Allow Authentication with User Credentials OR Client Certificate" option to "No." Additional information is available here: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab * https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-authentication-configuration-tab * https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/globalprotect/network-globalprotect-gateways/globalprotect-gateway-authentication-tab https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/globalprotect/network-globalprotect-gateways/globalprotect-gateway-authentication-tabhttps://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/globalprotect/network-globalprotect-gateways/globalprotect-gateway-authentication-tab

Information

This issue is fixed in PAN-OS 10.1.11, PAN-OS 10.2.4-h5, PAN-OS 10.2.5, PAN-OS 11.0.3, and all later PAN-OS versions.

Event History

Nov 13, 2024

Advisory Published

via Palo Alto Networks·05:00 PM

Advisory Published

via Palo Alto Networks·06:00 PM

Nov 14, 2024

CVE Published

via MITRE·09:38 AM

Data Sourced

via MITRE·09:38 AM

DescriptionWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-5918?

CVE-2024-5918 is classified as a high severity vulnerability due to its potential impact on user authentication.

How do I fix CVE-2024-5918?

To fix CVE-2024-5918, update your PAN-OS software to version 11.0.4 or later, 10.2.5-h5, or 10.1.12.

What systems are affected by CVE-2024-5918?