1. Home
  2. CVE Database
  3. CVE-2024-3387
MEDIUM · 5.3

CVE-2024-3387

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panor...

Vulnerability Description

A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sensitive information that is shared between the management server and the firewalls.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
PaloaltonetworksPan-Os>= 10.1.0, < 10.1.12

Related Weaknesses (CWE)

CWE-326

References

FAQ

What is CVE-2024-3387?

CVE-2024-3387 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panor...

How severe is CVE-2024-3387?

CVE-2024-3387 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-3387?

Check the references section above for vendor advisories and patch information. Affected products include: Paloaltonetworks Pan-Os.