Palo Alto Networks on Wednesday announced patches for vulnerabilities found in several of its products, including flaws that have been assigned a ‘high severity’ rating.
The most important vulnerability is CVE-2024-5914, described as a high-severity command injection issue affecting the company’s Cortex XSOAR security orchestration, automation and response (SOAR) product.
Specifically, the flaw affects the product’s CommonScripts Pack and allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container.
However, Palo Alto Networks noted that only certain configurations are impacted. Patches are being included in versions starting with 1.12.33.
Another advisory with an overall rating of ‘high severity’ describes vulnerabilities in the Prisma Access Browser. The browser is based on Chromium and the cybersecurity giant has now integrated the latest upstream security fixes, which cover over 30 vulnerabilities.
The company has also released advisories for two medium-severity issues: CVE-2024-5916, a PAN-OS bug that enables a read-only administrator to read secrets, passwords and tokens associated with external systems; and CVE-2024-5915, a GlobalProtect app flaw that allows a local attacker to escalate privileges.
Palo Alto Networks pointed out that it’s not aware of any malicious attacks exploiting these vulnerabilities.
However, threat actors targeting vulnerabilities in Palo Alto products is not unheard of. A few months ago, state-sponsored threat actors exploited a zero-day to deploy a backdoor on the company’s firewalls.
Related: Palo Alto Networks Addresses BlastRADIUS Vulnerability, Fixes Critical Bug in Expedition Tool
Related: Palo Alto Networks Announces Major Cybersecurity Partnership With IBM, Acquires QRadar SaaS Assets
Related: Palo Alto Networks Shares Remediation Advice for Hacked Firewalls
Related: Palo Alto Networks Patches Vulnerabilities Allowing Firewall Disruption
