Vulnerability identifier: #VU88505

Vulnerability risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-3383

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Palo Alto PAN-OS
Operating systems & Components / Operating system

Vendor: Palo Alto Networks, Inc.

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper group mmembership change issue. A remote attacker can cause impact to user access to network resources where users may be inappropriately denied or allowed access to resources.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Palo Alto PAN-OS: 11.0.0 - 11.0.2-h3, 10.2 - 10.2.4-h4, 10.1 - 10.1.10-h1

---

External links
http://security.paloaltonetworks.com/CVE-2024-3383

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.