CVE-2024-5920: PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator
Description
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate PAN-OS administrator's browser.
Classification
CVE ID: CVE-2024-5920
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.6
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:C/RE:M/U:Amber
Problem Types
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Affected Products
Vendor: Palo Alto Networks
Product: Cloud NGFW, PAN-OS, Prisma Access
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 16.49% (scored less or equal to compared to others)
EPSS Date: 2025-05-07 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2024-5920https://security.paloaltonetworks.com/CVE-2024-5920