Insufficient Session Expiration in Palo Alto PAN-OS - CVE-2024-0008
Published: February 15, 2024
Vulnerability identifier: #VU86541
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-0008
CWE-ID: CWE-613
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to gain access to sensitive information.
The vulnerability exists due to insufficient session expiration issue in the management interface. An attacker with physical access can obtain or guess session token and gain unauthorized access to session that belongs to another user.
Affected software
Palo Alto PAN-OS
RUGGEDCOM APE1808
RUGGEDCOM APE1808
How to mitigate CVE-2024-0008
Install updates from vendor's website.
Palo Alto PAN-OS - addressed in versions 9.0.17-h2, 9.0.18, 10.0.12-h1, 10.0.13, 10.1.10-h1, 10.1.11, 10.2.5, 11.0.2