CVE-2024-3387 - PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure

Back Back to CVE browser

MEDIUM

PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure

Published Apr 10, 2024

5.9

MEDIUM

CVSS 3.1

EPSS 0.17%

Description

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.

Affected products

Vendor Palo Alto Networks Product Pan-OS Default
unaffected
- Version
  10.1.0
  Status
  affected
  Constraints
  <10.1.12
- Version
  10.2.0
  Status
  affected
  Constraints
  <10.2.7-h3
- Version
  10.2.0
  Status
  affected
  Constraints
  <10.2.8
- Version
  11.0.0
  Status
  affected
  Constraints
  <11.0.4
- Version
  11.1.0
  Status
  unaffected
  Constraints
  -
- Version
  9.0.0
  Status
  unaffected
  Constraints
  -
- Version
  9.1.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Palo Alto Networks

Pan-OS

unaffected

Version	Status	Constraints
10.1.0	affected	<10.1.12
10.2.0	affected	<10.2.7-h3
10.2.0	affected	<10.2.8
11.0.0	affected	<11.0.4
11.1.0	unaffected	-
9.0.0	unaffected	-
9.1.0	unaffected	-

Vendor Palo Alto Networks Product Pan-OS Default
n/a
- Version
  10.1.0
  Status
  affected
  Constraints
  -
- Version
  10.2.2
  Status
  affected
  Constraints
  -
- Version
  11.0.0
  Status
  affected
  Constraints
  -