CVE-2024-3388 Vulnerability Details

  /     /     /  

CVE-2024-3388 Metadata Quick Info

CVE Published: 10/04/2024 | CVE Updated: 01/08/2024 | CVE Year: 2024
Source: palo_alto | Vendor: Palo Alto Networks | Product: PAN-OS
Status : PUBLISHED

---

CVE-2024-3388 Description

A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send network packets to internal assets. However, this vulnerability does not allow the attacker to receive response packets from those internal assets.

Metrics

CVSS Version: 3.1 | Base Score: 4.1 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* REQUIRED
    Scope (S)* CHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* LOW
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-269
CWE Name: CWE-269 Improper Privilege Management
Source: Palo Alto Networks

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-194
CAPEC Description: CAPEC-194 Fake the Source of Data


Source: NVD (National Vulnerability Database).